Liability & Clinical Research June 27, 2007

1. Liability & Clinical Research June 27, 2007 Adam Robison, Esquire Health Industry Group Vinson & Elkins LLP

2. I. Presentation Overview • Introduction • Types of Clinical Trial Liability • Tort • Constitution • Criminal • Regulatory/Statutory • Resources

3. I. Presentation Overview Billing Contract False Claims Act Informed Consent Misuse of Funds Research Misconduct Torts Conflicts of Interest Statutory Violations Regulatory Liability Constitutional Law Liability

4. II. Introduction Definitions • Definition of Legal Liability - Any legal responsibility where a failure to fulfill can give rise to claim for damages • Types of Legal Liability in Clinical Trials • Civil Liability (actual damages, punitive damages, injunctive relief) • Administrative Liability (penalties, recoupment, exclusion) • Criminal Liability (imprisonment, criminal penalties)

5. II. Introduction Who Sues • Research Subjects • Families or parents of research subjects • Federal and State government agencies • Institutions • Investigators • Sponsors

6. II. Introduction Who is Sued • Institutions & Employees • Researchers • Physicians • Sponsors, drug and manufacturers • IRB members

7. II. Introduction Who is Sued, Continued . . . Robertson v. McGee (N.D. Okla. 2002) • Allegations • Subjects in melanoma research alleged lack of informed consent, failure to comply with federal regulations, and breach of due process and right to be treated with dignity • Lawsuit against Oklahoma University School of Medicine, University administration, and individual IRB members • Settlement • Settlement included individual IRB members

8. III. Tort Liability

9. Tort Liability • Definition of Tort – A civil wrong arising from a breach of a duty not originating in contract. It is an act that injures someone in some way, and for which the injured person may sue the wrongdoer for damages.

10. Tort Liability • Examples of Torts Alleged In Connection With Clinical Trials: • Negligence – failure to act as a reasonable person would in similar circumstances • Negligence Per Se – eliminates the need to prove breach of duty; violation of a statute is negligence per se • Informed Consent • Battery – treatment without consent of the patient • Negligence – breach of the physician/researcher’s duty to disclose information about procedure and risks to patient • Breach of Fiduciary Duty – breach of duties of trust, confidence, and candor • Strict Products Liability – an absolute duty to make something safe; does not depend on a finding of negligence

11. Tort Liability Negligence and Products Liability • Quinn v. Abiomed (Pa. 2002) CHF patient participated in artificial heart study and died after months of painful complications. Subject’s wife sued hospital and hospital corporation, medical school, device manufacturer and patient advocate (PA) • Allegations: • Incomplete & misleading informed consent (cited “therapeutic misconception”) • Breach of fiduciary duty • Products liability • Result: • $ 125 K private settlement

12. Tort Liability Negligence Per Se • Daum v. Spinecare Medical Group, Inc. (1997) • Daum sued after unsuccessful spinal fusion surgery, claiming he was not informed surgical device was experimental and part of a clinical trial • Court allowed negligence per se claim based on physician-researcher’s failure to follow FDA regulations regarding informed consent

13. Tort Liability Informed Consent (Conflicts of Interest) • Jesse Gelsinger • In 1999, 18 year old research subject volunteered for gene transfer study at the University of Pennsylvania. After receiving large dose of viral vector, went into multiple organ failure and died. • Investigation revealed: • Consent form did not state that monkeys had died, and other humans had experienced serious side effects • Principal researcher did not disclose that he was the founder of the research company involved • Consequences: • Family sued university, director of bioethics program, and principal researcher for failing to inform about risks and previous adverse events • Private Settlement (amount not disclosed)

14. Tort Liability Informed Consent • Grimes v. Kennedy Krieger Institute, Inc. (2001) • 1993 research study involving healthy children living in low cost Baltimore housing aimed to compare methods of home lead abatement. Children were expected to continue living in homes, even after presence of toxic amounts of lead was revealed. • Allegations: • IRB wrongly approved the research and helped investigators get around federal regulations for the protection of children • Lack of informed consent • Breach of investigator’s special duty of care for vulnerable population • Result: • Families sued research institution and researchers for negligence and breach of contract • University and principal researcher sued by government

15. Tort Liability Informed Consent (Class Action) • Diaz v. Hillsborough County Hospital Authority (1990) • Class of women who participated in experimental treatment while pregnant • Allegations: • Flawed informed consent process • Violation of right to be treated with dignity • Result: • $ 3.8 million settlement

16. Tort Liability Informed Consent (Class Action) • In re Cincinnati Radiation (1994) • 1960’s radiation cancer study was characterized as “therapeutic,” though it lacked any therapeutic effect • Allegations: • Lack of informed consent • Result: • Class certification initially denied, then certified as “hybrid” class • Settlement for monetary award and injunctive relief

17. Tort Liability Informed Consent (Class Action) • Craft v. Vanderbilt University (1994) • 1940’s research on effects of radioactive iron on pregnant women and their fetuses; follow up studies in 1960’s • Complaint alleged failure to obtain informed consent • Court certified two classes: • Women who were subjects of the study • Children who were fetuses during the study • Plaintiffs awarded injunctive relief in the form of medical monitoring

18. Tort Liability Breach of Fiduciary Duty • Moore v. Regents of the University of California • In 1976, Moore was treated for hairy cell leukemia at UCLA Medical Center. Moore’s spleen was removed by Dr. Golde, allegedly to slow the disease progress • Over the next seven years, Moore returned to UCLA at Golde’s direction, as part of “treatment” • Golde obtained a patent and earned several hundred thousand dollars using Moore’s spleen cells and T-lymphocytes, but never informed Moore about the research

19. Tort Liability Breach of Fiduciary Duty Moore v. Regents of the University of California(cont.) • Moore sued Dr. Golde for breach of fiduciary duty: • Golde allegedly concealed his economic interest in Moore’s tissue and blood samples • Court said, “…the existence of a [physician’s] motivation for a medical procedure unrelated to the patient’s health is a potential conflict of interest and a fact material to the patient’s decision.” (Emphasis supplied) • Result does not prohibit research that will lead to patents or financial gain; when physician orders procedures, patient should be informed of the motivation, if any, besides treatment

20. IV. Constitutional Law Liability • Breach of due process right • Violation of liberty interests and right of “privacy” • Breach of right to be treated with dignity

21. Constitutional Law Liability • Robertson v. McGee (N.D. Okla. 2002) • Allegations • In addition to allegations of lack of informed consent and violations of federal regulations, complaint alleged breaches of right to be treated with dignity • Lawsuit against Oklahoma University School of Medicine, University administration, and individual IRB members • Settlement • Settlement included individual IRB members

22. V. Criminal Liability

23. Criminal Liability • U.S. v. Paul H. Kornak(N.D.NY. 2005) • Allegations: • Fraudulently enrolled participants who did NOT meet study criteria for an investigational cancer therapy • Criminally negligent homicide (One participant died following improper inclusion in the study) • Defrauding sponsor companies of over $600,000 • Result: • 1 year in prison • Required to reimburse drug sponsors • Lifetime debarment from Federal agency transactions

24. Criminal Liability • U.S. v. Eric Poehlman (D. Vt. 2005) • Allegations: • Making material false statements on a Federal research grant application • Result: • Lifetime debarrment from Federal funding • Lifetime exclusion from Federal health care programs • Must submit letters of retraction and correction addressing his scientific misconduct to scientific journals

25. VI. Regulatory and Statutory Liability Overview of Regulatory and Statutory Liability • Human Research Subject Protection • Privacy and Confidentiality • False Claims Act

26. Human Research Subject Protection History of Regulations • Jewish prisoners of the Holocaust were forced to undergo scientific “experiments” to observe the physical effects of: • Freezing • Malaria • High Altitude • Poison • Mustard Gas (as well as many others) • The Nuremberg Trial against 20+ German physicians began December 1946 • 16 were found guilty; Nazi War Crimes Tribunal set forth standards for research involving humans: “The Nuremberg Code”

27. Human Research Subject Protection Nuremberg Code Standards: • Voluntary Consent - voluntary, informed, and uncoerced • Benefits of participation should outweigh risks • Participants should have option to stop participating • Experiment should be conducted: • By qualified persons • With adequate preparation, and • At appropriate facilities to protect against harm to subjects • Researcher should be prepared to terminate experiment at any stage if likely to result in injury

28. Human Research Subject Protection Declaration of Helsinki • World Medical Association’s guidance to physicians engaged in biomedical research involving humans • Governs international research in two general areas: • Research as part of clinical care • Non-therapeutic research • Last revised 2000 • Basis for FDA “Good Clinical Practices”

29. Human Research Subject Protection National Research Act and Belmont Report • National Research Act (1974) • Created National Commission for the Protection of Human Subjects of Biomedical and Behavioral Research, which drafted the Belmont Report • Belmont Report (1979) • Statement of basic ethical guidelines for research with human subjects • Three core principles: • Respect for persons – Individual autonomy and protection for those with diminished autonomy • Beneficence – Maximize possible benefits and minimize possible harm • Justice – Fairness in distribution of benefits and burdens

30. Human Research Subject Protection HHS Policy For Protection of Human Research Subjects (Common Rule) 1981: • Regulations pass, based on Belmont Report • Department of Health and Human Services (HHS): Title 45 (public welfare) of Code of Federal Regulations (CFR), Part 46 (protection of human subjects) • Food and Drug Administration (FDA): Title 21 (food and drugs) CFR, Parts 50 (protection of human subjects) and 56 (Institutional Review Boards) 1991: • Other federal agencies adopt section of HHS regulations (45 CFR Part 46, Subpart A) • Known as the “Common Rule” Today: • Most federal agencies that support or conduct HSR have adopted the Common Rule

31. Human Research Subject Protection Common Rule (HHS) • Located at 45 CFR Part 46, Subpart A • Applies to: Research funded by federal agency and institutions who have agreed to comply through federal wide assurance (FWA) • Key provisions: • Institutional compliance • Informed consent must be obtained and documented by researcher • IRB requirements • Additional protections for “vulnerable” subjects: • Children • Pregnant women • Prisoners

32. Human Research Subject Protection Other Regulations and Guidance • FDA Regulations at 21 CFR Parts 50, 56 • Similar to the Common Rule • Research on new drugs, devices, etc. must comply with FDA regulations on HSR • FDA also issues guidance to assist IRBs, researchers, manufacturers and sponsors with regulatory compliance issues • HHS Office of Human Research Protection (OHRP) • Recent guidance (Jan. 2007) on reporting adverse and unexpected problems

33. Human Research Subject Protection Federal Enforcement Agencies • HHS Office for Human Research Protection, Division of Compliance Oversight (DCO) • HHS Office of Inspector General (OIG) • HHS National Institute of Science, Office of Research Integrity (ORI) • FDA Bioresearch Monitoring Program (BIMO) • U.S. Department of Justice (DOJ)

34. Human Research Subject Protection

35. Human Research Subject Protection Office for Protection of Human Subjects (OHRP) • Conducts complaint investigations and not-for cause investigations • Not-for-cause investigations can be triggered by relatively few reports of unanticipated problems or noncompliance • Findings of investigation published on OHRP website • Based on noncompliance with assurance, OHRP can: • Suspend all research conducted under assurance • Require notice of an institution’s or investigator’s past noncompliance to DHHS scientific peer review groups prior to review of new projects • Debar an institution or investigator from all government programs

36. Human Research Subject Protection Enforcement Action • John Hopkins University • In 2001, healthy college student volunteered for asthma study at Johns Hopkins University, but later died as a result of inhaling hexamethonium • Investigation revealed: • Failure to sufficiently consider history of hexamethonium • Failure to obtain IRB approval for protocol deviations • Failure of PI to timely report unanticipated adverse events to officials • Total of 31 research-related deficiencies identified (24 unrelated) • Administrative Consequences: • OHRP temporarily suspended all University’s federally-funded research (consisting of 2,400+ studies involving 15,000+ subjects); required University to submit and comply with plan of correction

37. Human Research Subject Protection • FDA Bioresearch Monitoring Program (BIMO) • Program of on-site inspections/data audits of clinical investigators, research sponsors, and IRBs involved in INDs to monitor compliance • Based on noncompliance with FDA requirements, agency can: • Withhold approval of new studies at the institution or reviewed by the IRB • Prohibit new subjects from being added to ongoing studies • Terminate ongoing studies • Notify regulatory agencies/other parties of the deficiencies in the operation of an IRB • Disqualify institution or IRB • FDA will not approve an application for a research permit • May refuse to consider data from disqualified institution in agency’s consideration of a marketing permit application

38. Human Research Subject Protection Enforcement Action • Tufts University School of Medicine • FDA put four gene therapy studies at St. Elizabeth’s Medical Center on clinical hold after PI failed to promptly report deaths of two volunteers • Studies sought to use gene therapy to reverse heart disease • At least one death may have been related to study treatment • St. Elizabeth’s submitted plan of correction in Feb. 2000 • Enhancement of IRB responsibilities, especially with respect to reviewing and reporting adverse events • Development of a training program relating to adverse event reporting • Updating of all adverse events associated with gene therapy research conducted by Dr. Isner • Simplification of documentation of IRB policies

39. Privacy and Confidentiality

40. HIPAA Privacy Rule: Protected Health Information (PHI) is any data that contains at least one of the following: Name Social security numbers Street address, city, county, precinct, zip code, and equivalent geocodes All elements of dates (except year) for dates directly related to an individual and all ages over 89 Telephone numbers Fax numbers Electronic mail addresses Medical record numbers Health plan ID numbers Account numbers Certificate/license numbers Vehicle identifiers and serial numbers, including license plate numbers Device identifiers/serial numbers Web addresses (URLs) Internet IP addresses Biometric identifiers, incl. finger and voice prints Full face photographic images and any comparable images Any other unique identifying number, characteristic, or code Privacy and Confidentiality

41. Privacy and Confidentiality HIPAA Privacy Rule: • PHI can only be used in a clinical trial if it is: • De-identified (or partly de-identified) • Authorized to be used by the subject • Approved for use by an IRB • To be used in preparation for research, or to recruit subjects • Information from a decedent (with certain restrictions) • Required by law to be disclosed, or • “Grandfathered” research under HIPAA

42. Privacy and Confidentiality HIPAA Enforcement Actions • Regulated by Office of Civil Rights • Civil Penalties: $100 per violation, limited to $25k per year • Enforcement: To date, OCR has engaged only in educational efforts. • Criminal prosecutions referred to Department of Justice • Criminal : • $50k and up to 1 year in prison for knowingly use/cause to be use health identifier, obtains identifiable health info, or discloses identifiable health info • $100k and up to 5 years in prison if committed under false pretenses • $250k if committed with intent to sell, transfer, or use for personal advantage, gain, or malicious harm • To date, DOJ has prosecuted 4 defendants (employees of health care entities) for egregious HIPAA violations, including theft and sale of individually identifiable health information

43. Privacy and Confidentiality HIPAA Violations in the Context of Research Examples: • To recruit subjects for a new HIV drug clinical trial, the PI asks a hospital employee to look through medical records of patients to find names of individuals who are HIV positive so that he may contact them directly about participating in the study. • After blood is drawn for a routine blood test on a patient who has a rare form of leukemia, the physician instructs a hospital employee to save a portion of the sample, marked with the patient’s name, for research purposes. • A researcher has properly obtained tissue samples for a study on kidney stones. Unfortunately, funding fell through for the study, but now she wants to use the samples for a new clinical investigation on genetic kidney disease. The tissue samples are marked with the subjects’ social security numbers

44. Privacy and Confidentiality Common Rule: Privacy Requirements • Generally, the IRB must determine that there are adequate provisions in the protocol to: • Protect the privacy of subjects • Safeguard confidentiality of sensitive private health information • If PHI is properly coded, it is not considered human subject research under the Common Rule, but may still be treated as PHI under HIPAA

45. False Claims Act Liability

46. False Claims Act Liability • Under the FCA, any person who: • Knowingly presents or causes to be presented a false or fraudulent claim for payment or approval • Knowingly makes, uses, or causes to be made or used, a false record or statement to get a false or fraudulent claim paid or approved by the Government, or • Conspires to defraud the Government by getting a false or fraudulent claim allowed or paid • Is liable to the U.S. Government for: • Civil penalty between $5,500 and $11,000 per claim, plus treble damages

47. False Claims Act Liability • Types of false claims in research: • Upcoding, overbilling, and double-billing for services • Billing for services not rendered or not covered • Improperly billing government before other payors • Other violations that may give rise to a “false claim” • Engaging in scientific misconduct • Investigator submission of false reports or false data • Fraud in obtaining or misusing federal grant funds • Conflicts of interest • Failure to comply with federal informed consent requirements

48. False Claims Act Liability Medicare Secondary Payer • Medicare Secondary Payer laws prevent Medicare from paying as primary payer in certain situations • Medicare is generally billed second • It is illegal to bill the government for items or services that are to be paid for by the research sponsor • Knowingly submitting claims in violation of the MSP laws violates the FCA

49. False Claims Act LiabilityMedicare Secondary Payer • U.S. ex. rel McCaslin v. Harris County Hospital District (2003) • Allegations: • Submitting claims to Medicaid and Medicare where those payors were not primary • Submitting claims to Medicaid and Medicare for items and services provided to incarcerated individuals • Result: • $15.4 million settlement (announced June 2007) • Hospital District entered into Compliance Agreement with HHS OIG to ensure future compliance

50. False Claims Act LiabilityBilling for Noncovered Services Medicare Coverage Associated with Clinical Trials • Medicare Coverage Policies: • Generally, items or services related to experimental drugs or devices are not covered by Medicare. 42 USC 1395y(a)(1)(A) • 2000 President Clinton’s Executive Memo authorized Medicare payment for routine patient costs • 2001 CMS National Coverage Decision (NCD) • Authorizes payment for routine patient care costs associated with qualifying clinical trials • 2007 Proposed NCD policy • Revised coverage rules for Routine Clinical Services • Knowingly filing false/fraudulent claim for payment in violation of NCD violates FCA