Medtronic 2012 Annual Report Download - page 31

officers, employees, or us. The U.S. FDA may also recommend prosecution to the DOJ. Conduct giving rise
to civil or criminal penalties may also form the basis for private civil litigation by third-party payers or other
persons allegedly harmed by our conduct.
The U.S. FDA, in cooperation with U.S. Customs and Border Protection (CBP), administers controls
over the import of medical devices into the U.S. The CBP imposes its own regulatory requirements on the
import of our products, including inspection and possible sanctions for noncompliance. Medtronic is also
subject to foreign trade controls administered by several U.S. government agencies, including the Bureau of
Industry and Security within the Commerce Department and the Office of Foreign Assets Control within
the Treasury Department.
The U.S. FDA also administers certain controls over the export of medical devices from the U.S.
International sales of our medical devices that have not received U.S. FDA approval are subject to U.S. FDA
export requirements. Many countries outside the U.S. to which we export medical devices also subject such
medical devices to their own regulatory requirements. Frequently, we obtain regulatory approval for medical
devices in countries outside the U.S. first because their regulatory approval is faster than that of the
U.S. FDA. However, as a general matter, non-U.S. regulatory requirements are becoming increasingly
common and more stringent.
In the EU, a single regulatory approval process exists, and conformity with the legal requirements is
represented by the CE Mark. To obtain a CE Mark, defined products must meet minimum standards of
performance, safety, and quality (i.e., the essential requirements), and then, according to their classification,
comply with one or more of a selection of conformity assessment routes. A notified body assesses the quality
management systems of the manufacturer and the product conformity to the essential and other
requirements within the medical device directive. Medtronic is subject to inspection by notified bodies for
compliance. The competent authorities of the EU countries, generally in the form of their ministries or
departments of health, oversee the clinical research for medical devices and are responsible for market
surveillance of products once they are placed on the market. We are required to report device failures and
injuries potentially related to product use to these authorities in a timely manner. Various penalties exist for
non-compliance with the laws transcribing the medical device directives.
To be sold in Japan, most medical devices must undergo thorough safety examinations and demonstrate
medical efficacy before they are granted approval, or “shonin.” The Japanese government, through the
Ministry of Health, Labour, and Welfare (MHLW), regulates medical devices under the Pharmaceutical
Affairs Law (PAL). Oversight for medical devices is conducted with participation by the Pharmaceutical and
Medical Devices Agency (PMDA), a quasi-government organization performing many of the review
functions for MHLW. Penalties for a company’s noncompliance with PAL could be severe, including
revocation or suspension of a company’s business license and criminal sanctions. MHLW and PMDA also
assess the quality management systems of the manufacturer and the product conformity to the requirements
of the PAL. Medtronic is subject to inspection for compliance by these agencies.
The process of obtaining approval to distribute medical products is costly and time-consuming in
virtually all of the major markets where we sell medical devices. We cannot assure that any new medical
devices we develop will be approved in a timely or cost-effective manner or approved at all.
Federal and state laws protect the confidentiality of certain patient health information, including patient
medical records, and restrict the use and disclosure of patient health information by health care providers.
In particular, in April 2003, the U.S. Department of Health and Human Services (HHS) published patient
privacy rules under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and, in
April 2005, published security rules for protected health information. The HIPAA privacy and security rules
govern the use, disclosure, and security of protected health information by “Covered Entities,” which are
health care providers that submit electronic claims, health plans, and health care clearinghouses. In 2009,
Congress passed the HITECH Act, which modified certain provisions of the HIPAA privacy and security
rules for Covered Entities and their Business Associates (which is anyone that performs a service on behalf
of a Covered Entity involving the use or disclosure of protected health information and is not a member of
the Covered Entity’s workforce). These included directing HHS to publish more specific security standards,
and increasing breach notification requirements, as well as tightening certain aspects of the privacy rules.
HHS has proposed, but not finalized, these new rules. In addition, the HITECH Act provided that Business
Associates will now be subject to the same security requirements as Covered Entities, and that with regard
14