Agenda EFPIA Disclosure Rules - Basics Latest Developments in Transcription As of 1/15/14 1
EFPIA Released its Final Disclosure Code That Binds 33 Pharmaceutical Associations And 40 Pharmaceutical Companies European Federation of Pharmaceutical Industries and Associations EFPIA represents: 33 European national pharmaceutical associations 40 pharmaceutical companies Membership is voluntary First reporting in June 2016, for 2015 data. Provides detailed disclosure of transfers of value to HCPs and HCOs Industry Efforts Four Key Areas AIMS Access Speed up regulatory approval and reimbursement process Remove government controls on medication that is not reimbursed Innovation Making Europe attractive for Research Ensure fair reward for innovation Mobilization EFPIA Deliver Responses modern medicine to Amended Transparency Fight damaging Directive cost-containment : policies Security Need to strengthen integrity and transparency Raising public awareness 2
Two Distinct Disclosure Requirements: Individual And Aggregate Individual Disclosure: Member Company shall disclose per Recipient Transfers of Value to individual HCO: 1. Donations and Grants 2. Contribution to Costs Related to Events Registration Fees Sponsorship Agreements Travel and Accommodation 3. Fees for Service and Consultancy Report Fees and Expenses separately Transfers of Value to individual HCP: 1. Contribution to Costs Related to Events Registration Fees Sponsorship Agreements Travel and Accommodation 2. Fees for Service and Consultancy Report Fees and Expenses separately Whenever possible, track payment to individual HCP, rather than HCO Aggregate Disclosure Data Privacy: Where national law forbids individual disclosure, report aggregate amount to unnamed recipients. Aggregate Research and Disclosure: Development: Research and Development Member Company must disclose the total amount of Transfers of Value relating to the category of research and development. 3
EFPIA Disclosure Code Requirements Exceptions to Disclosure Requirement Disclosure under EFPIA is not required for the following Transfers of value Meals and Drinks Medical Samples Transfers of Value that are part of the ordinary course purchase and sales of medicinal products Transfers of Value related to over-the-counter medicines Where To Report: Based On Address, Place of Primary Practice, Or Of Incorporation Of European HCP/HCO Europe, for purposes of EFPIA, includes: Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Malta, the Netherlands, Norway, Poland, Portugal, Romania, Russia, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey, Ukraine and the United Kingdom. 4
EFPIA: First Report Due In June 2016 24 Jun 2013 19 Aug 2013 31 Dec 2013 1 Jan 2015 2016 Disclosure Code & amendments to the HCP Code approved by the EFPIA General Assembly Final Disclosure Code released to the public Deadline for EFPIA Member Associations to implement Disclosure Code Integrate into respective national member codes Start of reporting period Begin to collect required data under new national disclosure codes First year of reporting Data to be provided no later than 30 June 2016 Member Companies Must Disclose Transfers of Value: Reporting is Annually (France is every 6 months) Beginning in 2016 (for Transfers of Values made in 2015) Within 6 months of the end of the reporting period On the company s website or on a central platform such as one provided by the relevant government, regulatory or professional authority or body Using the template provided by EFPIA (see next slide) where possible 5
EFPIA Has Provided A Disclosure Template Link http://transparency.efpia.eu/efpia%20disclosure%20code%20schedule%202%20template%20final.pdf 6
Member Associations Must Adopt The Disclosure Code As Minimum Provisions, And May Choose To Go Even Further EFPIA rules to be transcribed into national codes by end of 2013; will add to existing national rules. EFPIA sets out the minimum standards for reporting Deviations allowed where specific provisions of code conflict with applicable national laws Member Associations given discretion over dates, enforcement, and other issues. Member Companies shall be bound by the relevant Member Association s code in each country in Europe in which they operate (whether directly or through the relevant subsidiary). EFPIA Members, including all subsidiaries, must comply with national codes in all European countries, even if not a member of a particular country s Member Association The industry is hoping that Member Associations will solve various grey areas, notably regarding method and timeline of reporting, itemization vs. aggregation, and data privacy 7
Member Associations Have Begun Transcribing the EFPIA Code Into Their National Rules, But Hoped For Clarifications Are Missing To date, only a handful of key countries have published new Codes of Practice, despite December 31 deadline. Countries include: UK Spain Switzerland Early review finds that countries are not extending reporting requirements beyond EFPIA s stated minimum Member Associations have, so far, repeated that national privacy laws may not permit disclosure of certain individuals, but have not provided any further guidance for interpreting those laws 8
ABPI (UK) As A Model of EFPIA Country Transcription ABPI Disclosure rules generally follow EFPIA minimum All research payments, including consulting payments related to research, are completely aggregated June 30 th, 2016, confirmed as first reporting deadline Company website as venue for reporting But: if a central platform for disclosure in the UK is established, the use of that platform is likely to be obligatory Companies need not report individual payments (only total payment amount to individual per year) No guidance regarding aggregation for national data privacy rules ABPI did make several minor additions to the EFPIA Appropriate administrative staff added as covered recipients Report Joint Working payments made to NHS 9
EFPIA Sets a Minimum Standard For All Member Countries; Additional National Rules May Apply National Legislation: EFPIA rules Operate in Addition to the National Law Example: France Meals, other gifts must still be disclosed in the government mandated manner, as required by the French Sunshine Law French Member Association will clarify how to deal with overlap and contradictions between EFPIA and French law Where following EFPIA Code VIOLATES national law (e.g., data privacy law): Member Companies must always follow the law, but document why they could not comply with the EFPIA Code Where the Member Association Codes include requirements that go beyond the EFPIA Disclosure Code, national rules should continue to apply Enforcement Each Member Association will determine a system of sanctions in its national code, and enforce those sanctions on its members Sanctions to be proportionate to the the nature of the infringement 10
Privacy Laws In Europe Can Impact Reporting Requirements The European Union has the Data Protection Directive (Directive 95/46/EC) which sets a minimum standard for privacy. Each EU country has implemented it into its laws, but may have its own privacy rules that may go further. Germany, notably, is considered to have particularly strong privacy laws. There are stronger and more unifying rules proposed. The EC has proposed the General Data Protection Regulation (GDPR), which will do a lot to standardize data privacy across the EU. The terms and timeframe, though, are very much in doubt, and you could still have countries that go beyond it. 11
Agenda EFPIA Disclosure Rules - Basics Latest Developments in Transcription As of 1/15/14 12
Member Associations Must Adopt The EFPIA Disclosure Code As Minimum Provisions, And May Choose To Go Further EFPIA mandated that the 33 member associations transcribe the EFPIA Code into their national codes by end of 2013 EFPIA Code sets out the minimum standards for reporting; country associations may place more demanding rules Deviations allowed where specific provisions of code conflict with applicable national laws Member Associations given discretion over dates, enforcement, and other issues. 40 Full EFPIA Member Companies including all subsidiaries, must comply with national codes in all European countries Even if not a member of a particular country s Member Association Companies belong to certain member associations, but not EFPIA itself, must only comply in countries of membership Rules to follow are based on residency of HCP/O recipient The industry has been hoping that member associations will: Solve various grey areas, like: guidance on national privacy laws, how consent impacts reporting when itemize vs aggregate, and pragmatic issues, where and when to file and how to file Provide guidance on how code will interact with local law, specifically privacy law 13
Ten EFPIA Member Associations Have Published Transcribed Versions of the EFPIA Disclosure Code Into Their National Codes 10 EFPIA Disclosure Code Transcribed into Member Associate National Codes 10 Reports Indicate a Transcribed Code, Awaiting Final Approval and Publication 13 remaining transcribed Code Delayed For Review of Data Privacy or Other Considerations Note: for the 40 EFPIA Member Companies and their affiliates, disclosure will be mandatory across Europe regardless of transcription (default to standard code if country does not transcribe) 14
Polaris Analyzed the Codes of Conduct of All 33 Member Associations Generally in Line With EFPIA Country* Beyond EFPIA? Guidance on Data Privacy Cross-Border Disclosure Where to Report? Additional Notes Bulgaria No None No detail Company website Minimal statement of implementation Estonia No None No detail Minimal details on EFPIA Code Finland No Uses EFPIA language, no additional guidance Ireland No Uses EFPIA language, no additional guidance Italy No Consent required for itemized disclosure No detail Company website Data Protection Ombudsman to provide guidance directly to member companies Provides additional detail Company website Broad scope definition of research No detail Company website Not translated into English Norway No Consent required for itemized disclosure Provides additional detail Company website Slovenia No Consent required for any transfer of value (no consent = no contract) Spain No HCP may revoke consent, requiring editing of disclosure No detail Company website Limits ability to revoke consent to disclose after transfer of value No detail Company website Exclusion if not solely related to Rx medicines, materials Switzerland No Consent for HCOs No detail Company website - Promised future guidance on data privacy, etc. - Enforcement by mediation process United Kingdom Slightly broader definition of reportable recipients Uses EFPIA language, minimal additional guidance Provides additional detail, rules Company website, awaiting public register Added detail re: NHS * Click on country names for links to codes Note: more countries have transcribed Polaris since 2014 publication of this document 15
A Review of All Newly Published Codes Shows Several Trends (1 of 3) No new major restrictions beyond the minimum required by the EFPIA Code Example: all countries maintain aggregated reporting for research payments; Payments must only be itemized by recipient and type, not by individual transaction (except where requested by authorities) Minor exception: UK slightly expands the definition of those HCPs covered. Requires reporting of payments/tovs to certain individuals who can recommend medicines who are not covered under the EFPIA Code Publication is on company websites for now EFPIA Code allows member associations to designate location of reporting All codes, so far, call for publication of results on company website Possible development of central portals in future. For example, ABPI Code: Disclosure will be on the company s website but, if a central platform for disclosure in the UK is established, the use of that platform is likely to be obligatory All codes, so far, state that reporting will be the calendar year, and so confirm that first deadline will be June 30, 2016, then yearly thereafter All countries require a methodology statement Most member associations are requiring companies to publish a note, along with the disclosure, summarizing the methodologies used by it in identifying and disclosing ToVs (including statement on treatment of VAT, tax, currency, timing, etc ) Trends in line with the 10 unpublished codes Note: more countries have transcribed since publication of this document 16
A Review of All Newly Transcribed Codes Shows Several Trends (2 of 3) Some countries define cross-border disclosure more specifically Ireland, Norway specify the procedure for cross-border transactions Disclosures in the country where the recipient has its physical address (where the HCP practices) Subsidiary or affiliate of is responsible for disclosure in that jurisdiction To ensure compliance, recommended that internal company procedure If company is not a resident or does not have an affiliate in the country where the recipient has its physical address disclose ToV consistent with the national code to which it is subject Countries define research broadly, or not at all National codes either leave research undefined, or define research payments, to be disclosed in the aggregate, as: ToVs to HCPs and HCOs related to the planning or conduct of: Non-clinical studies, Clinical trials, and Non-interventional studies that are prospective in nature and that involve the collection of patient data Relevant because companies may include more payments into aggregated payments bucket Every other payment has to be reported in detail Note: more countries have transcribed since publication of this document 17
A Review of All Newly Transcribed Codes Shows Several Trends (3 of 3) There is minimal guidance on interaction with national law Most transcribed codes provide very little insight on whether the requirements of the Code violate any national laws such as data privacy laws Codes repeat EFPIA language without further detail Industry had hoped member associations would provide local legal expertise Puts the burden on companies to determine risks Exception: Consent see below Switzerland, the EFPIA member organization has listed a member of the organization responsible to providing guidelines to the member organizations Countries elect different impacts of consent and non-consent Codes recommend to include contract clauses guaranteeing consent for disclosure Italy and Norway make consent a requirement for itemized disclosure No or revoked consent results in aggregate disclosure Possible that no HCP will consent Slovenia makes consent mandatory part of the contract. So no contract no consent and no payment! Standard consent form provided HCP cannot revoke consent after payment is made Ireland provides an example consent clause (see following slide) Consent typically limited to HCP contracts; 1 code (Ireland) suggests consent for HCOs Reports suggest that Serbia, Poland to follow Italian model (no consent = no disclosure), with Poland allowing for HCP revocation of Consent (Germany expected). Reports also suggest Greece will follow Slovenian model (no consent = no payment/contract) 18
Adoption Timing Is Expected To Vary and Be Protracted If company is EFPIA member: need to report by 2015 10 out of 33 countries have published transcribed EFPIA Code into local codes Some countries, with significant existing requirements, are expected to release a national code over the next 3-6 months (NL, Fr, D, etc) Historically some of the smaller countries were 2 years late adopting the HCP and HCO and patient organization codes that EFPIA released Multiple country associations, including France and Germany, are delaying publication of transcribed codes until approval from government bodies and HCP professional organizations regarding legality of compliance Note: more countries have transcribed since publication of this document 19
Why Are Data Privacy and Protection Laws So Relevant to EFPIA Reporting? Data Privacy rules restrict the general release of personal information, including financial information, which is the very subject of transparency reporting Data privacy rules are why the French Sunshine Law limited reporting to benefits and exclude service fee payment If company violates data privacy laws in order to comply with the EFPIA Code, it can face penalties much more severe than if it had ignored the EFPIA Code As the EFPIA Code is not a governmental law, it does not receive exemptions from privacy law Data privacy and protection laws also regulate how data can be shared within companies, especially across borders Possible concern in cross-border transactions This is not a new situation there is no additional risk The European Union is excepted to adopt a new EC directive in 2014, with regulation to take effect in 2016 Directive would heightened protection rules throughout Europe, creating additional burdens but allowing for one European-wide approach Overrule the national approaches Germany considered to have one of the most restrictive rules Note: more countries have transcribed since publication of this document 20
Polaris Contacts Name Role Email Phone Greg Hawley, JD Consultant; Global Transparency SME ghawley@polarismanagement.com O: 415.202.6088 C: 202.679.8005 www.polarismanagement.com 100 Broadway 7 th Floor New York NY 10005 212.502.1870 21