Medco 2015 Annual Report Download - page 19

17 Express Scripts 2015 Annual Report
Other Licensure Laws. Many states have licensure or registration laws governing PBMs and certain types of managed
care organizations and insurance companies, including, but not limited to, preferred provider organizations, third-party
administrators and companies that provide utilization review services. The scope of these laws differs from state to state, and
the application of such laws to the activities of PBMs and insurance companies is often unclear. We have registered under such
laws in those states in which we have concluded such registration is required either due to our various PBM services or the
activities of our licensed insurance subsidiaries. Moreover, we have received full accreditation for Utilization Review
Accreditation Commission Pharmacy Benefit Management version 2.0 Standards, which includes quality standards for drug
utilization management. In addition, accreditation agencies’ requirements for managed care organizations such as the National
Committee on Quality Assurance and Medicare Part D regulations for Medicare Part D and Medicare Advantage Prescription
Drug Plans may affect the services we provide to such organizations.
Legislation regulating PBM activities in a comprehensive manner has been and continues to be considered in a
number of states. In the past, certain organizations, such as the National Association of Insurance Commissioners (“NAIC”), an
organization of state insurance regulators, have considered proposals to regulate PBMs and/or certain PBM activities, such as
formulary development and utilization management. While the actions of the NAIC would not have the force of law, they may
influence states to adopt model legislation that such organizations promulgate. Certain states have adopted PBM registration
and/or disclosure laws and we have registered under such laws and are complying with applicable disclosure requirements. In
addition to registration laws, some states have adopted legislation mandating disclosure of various aspects of our financial
practices, including those concerning pharmaceutical company revenue, as well as prescribing processes for prescription
switching programs and client and provider audit terms. Other states are considering similar legislation, and as more states
consider these bills it will be difficult to manage the distinct requirements of each.
FDA Regulations. The Health Reform Laws provide a regulatory approval pathway for biosimilars (alternatively
known as generics) for biological products and provide an innovator biological product will be granted an exclusivity period of
12 years. At this time, we are unable to fully evaluate the impact of the regulatory changes regarding biosimilars on our
business and financial results.
Our clinical research activities are also subject to a number of complex and stringent regulations. We offer services
relating to the conduct of clinical trials and the preparation of marketing applications and are required to comply with
applicable regulatory requirements governing, among other things, the design, conduct, performance, monitoring, auditing,
recording, analysis and reporting of these trials. In the United States, the FDA governs these activities pursuant to the agency’s
Good Clinical Practice regulations.
HIPAA and Other Data Privacy and Security Legislation. Many of our activities involve the receipt or use of
confidential health and other personal information. In addition, we use aggregated and de-identified data for our own research
and analysis purposes and, in some cases, provide access to such data to pharmaceutical manufacturers and third-party data
aggregators. Various federal and state laws, including the Health Insurance Portability and Accountability Act of 1996
(“HIPAA”), regulate and restrict the use, disclosure and security of certain personal information, including health information,
and new legislation is proposed from time to time in various states.
The privacy regulations included as part of HIPAA impose restrictions on the use and disclosure of individually
identifiable health information by certain entities. The HIPAA security regulations provide controls related to the access to and
disclosure of protected health information when it is maintained or transmitted electronically. Other HIPAA requirements relate
to (i) electronic transaction standards and code sets for processing of pharmacy claims, (ii) privacy and security requirements
vis-à-vis business associates, (iii) breach analysis and notification requirements, (iv) limits on how information is used and
disclosed for marketing and fundraising purposes, and (v) limits on the use of a patient’s health information without his or her
permission. As with many other companies subject to HIPAA and related laws, it may have significant operational and legal
consequences for our business.
We believe we are in compliance in all material respects with HIPAA and other state privacy laws. To date, no patient
privacy laws have been adopted that materially impact our ability to provide PBM and pharmacy services, but there can be no
assurance federal or state governments will not enact legislation, impose restrictions or adopt interpretations of existing laws
that could have a material adverse effect on our business and financial results.
Environmental and Safety Regulations. We are required to comply with certain federal, state and local laws and
regulations regarding environmental protection, employee safety, and public health. Any failure to comply with these
regulations could result in fines or other sanctions by governmental bodies or entities.
Other Business Operations Services. Many of the laws and regulations cited above with respect to our PBM activities
also apply with respect to our various Other Business Operations services, including the federal and state anti-kickback laws,
state pharmacy regulations and HIPAA. In addition, as a condition to conducting our wholesale business, we must maintain