Looking Back on Supreme Court Impacts in Public Health Law, 2022-23

by: Erica N. White, J.D.; Jennifer L. Piatt, J.D.

The 2023-24 U.S. Supreme Court term contains multiple cases with significant nation-wide impacts on public health, including FDA powers to regulate specific medications, supremacy of federal emergency health care laws, and judicial deference to administrative agency interpretations generally. Previously, in its 2022-23 term, the Court drastically changed the public health landscape nationally, issuing far-reaching opinions limiting civil rights initiatives, expanding First Amendment protections, strictly controlling the reach of federal administrative agencies, and generally protecting commercial or industry interests over clear threats to the public’s health. 

The Center for Public Health Law & Policy at ASU’s Sandra Day O’Connor College of Law, in its second annual assessment, identified the 2022-23 term’s “top 10” Supreme Court public health-related actions. 

Several cases impacted civil rights. In companion cases brought against Harvard University and the University of North Carolina-Chapel Hill, the Court overruled decades-old affirmative action precedent. Projected limitations on race considerations in public and private allocations extend past the education sector. However, the Court rejected Alabama’s attempts to racially gerrymander its voting districts based on likely Voting Rights Act violations, leaving the law in place. However, the Court rejected notions that treaties with the Navajo Nation implicated affirmative federal duties to defend the Tribe’s water rights, even as the Colorado River is historically depleted.

The Court remains hesitant to apply existing statutory laws to the internet. Despite the platforms’ use by known terrorists, the Court declined to extend liabilities to internet platforms Google and Twitter for mere use of the websites. Similarly, the Court found that individuals making threatening social media messages could not be found criminally liable without a heightened “true threat” showing. The Court continued its expansion of First Amendment protections by favoring a Colorado website developer’s discrimination against customers based on their sexual orientation or gender identity. 

The Court continued its hostile treatment of administrative authorities while upholding strong executive authorities over immigration. The Court struck down the Biden-Harris Administration’s student loan forgiveness plan in August 2023 as too politically and economically significant for agencies to regulate absent specific legislation, exceeding the Department of Education’s statutory authority. However, the Court declined to extend standing to Texas and Louisiana in challenges to the Biden-Harris Administration’s immigration policies, finding no ability for states to contest executive immigration prosecutorial authorities. And, the Court upheld private actions pursuant to a federal nursing home reform statute, finding “unambiguous” individual recovery rights in the law. 

“Shadow docket” Court action during the 2022-23 term was also significant. In April 2023, the Court stayed a Texas federal court decision condemning mifepristone, part of the two-drug “abortion pill” regime, as unconstitutionally approved by FDA. The Court will undoubtedly assess this case more fully during the upcoming term, and its decision may impact not only abortifacients, but the FDA’s overall scheme to approve safe and effective drugs for circulation in interstate commerce.

Following the conclusion of the Court’s 2023-24 term in late June 2024, public health legal scholars will re-visit the term, providing analysis and predictions of the impacts going into the following 2024-25 term.

FDA’s New Proposed Rule to Regulate Laboratory-Developed Tests

By: Max Mashal, Juris Doctor Candidate (Class of 2025), Sandra Day O’Connor College of Law at Arizona State University

Introduction

On September 29, 2023, the U.S. Food and Drug Administration (FDA) announced a proposed rule that would classify laboratory-developed tests (LDTs) as “devices” under the Federal Food, Drug, and Cosmetic Act (FDCA) by amending the definition of in vitro diagnostic products (IVDs) under 21 C.F.R. § 809.3(a).[1] If this rule is implemented, LDTs will now have to meet the same regulatory standards as other FDA-regulated medical devices.[2]

Laboratory-Developed Tests

Laboratory-developed tests are in vitro diagnostic products that are designed, manufactured, and used within a single clinical laboratory which meets certain laboratory requirements (including CLIA certification).[3] Until recently, LDTs were mainly used for rare diseases and low-volume testing.[4] Now, they are widely-used by a more diverse population, thanks to high-tech instrumentation and software.[5] LDTs can now be used to diagnose and treat complex diseases, act as companion diagnostics for personalized medicine, and can be rapidly adapted to address emergency responses.[6]

However, unlike other IVDs, LDTs have not historically been subject to the FDA’s regulatory oversight.[7] The FDA has exercised enforcement discretion over LDTs for decades, allowing them to enter the market without FDA approval or clearance.[8] This has created a regulatory gap that poses significant risks to public health, as some LDTs may be inaccurate, unsafe, or ineffective.[9]

Phasing Out the FDA’s Enforcement Discretion Policy

Under the proposed rule, the FDA would implement a phased approach to end its enforcement discretion policy over a period of one to four years after the publication of the final rule.[10] The transition period would vary depending on the risk level of the LDTs, with high-risk tests being subject to premarket review earlier than moderate-risk or low-risk tests.[11] The FDA estimates that about 50% of the current LDTs are low-risk tests that may be exempt from premarket review under the new regulations.[12]

Under the proposed rule, the FDA has structured the phaseout policy as follows:

  • One Year After Publication: The FDA’s general enforcement discretion approach would end with respect to Medical Device Reporting (MDR) requirements, as well as correction and removal reporting requirements.
  • Two Years After Publication: Enforcement discretion would also end for other requirements. This would exclude MDR, correction and removal reporting, Quality System (QS) regulations, and premarket review. LDTs will then need to comply with FDA regulations related to registration, listing, labeling, and investigational device exemptions.
  • Three Years After Publication: Enforcement discretion would end for QS requirements.
  • Three and a Half Years After Publication:[13] Enforcement discretion would end for premarket review requirements for high-risk IVDs, subjecting Class III LDTs to full Pre-Market Approval requirements under the FDCA.
  • Four Years After Publication:[14] Enforcement discretion would end with respect to premarket review requirements for moderate and low risk IVDs needing premarket review. Class II and certain Class I LDTs would need to meet full 510(k) premarket and de novo requirements under the FDCA. The proposed rule suggests the FDA will not enforce actions against LDTs for which 510(k)s and de novo applications are submitted within this four-year period until the FDA review concludes.

Closing the Theranos Loophole

The FDA’s proposed rule aims to ensure the safety and effectiveness of LDTs, foster innovation, and align with evolving healthcare needs. It also intends to close a loophole which has been exploited by companies like Theranos, a startup that claimed to offer revolutionary blood tests that could perform hundreds of analyses with a single drop of blood.[15] Theranos’ tests were found to be unreliable, inaccurate, and fraudulent, putting patients at risk of misdiagnosis and mistreatment.[16] The company was able to market its tests without FDA approval by exploiting this regulatory loophole for LDTs.[17] The FDA’s proposed rule is intended to prevent such cases from happening again by requiring all LDTs to comply with the same regulatory standards as other medical devices.[18]

Conclusion

The FDA’s proposed rule is expected to face challenges and legal disputes from stakeholders who may oppose the agency’s authority over LDTs or fear the impact of the proposed regulations on their businesses.[19] The public comment period for the proposed rule closed on December 04, 2023.[20]

[1] Medical Devices; Laboratory Developed Tests, Federal Register (2023), https://www.federalregister.gov/documents/2023/10/03/2023-21662/medical-devices-laboratory-developed-tests (last visited Oct 11, 2023).

[2] Harsh Parikh et al., FDA proposes new regulations to increase oversight of Laboratory Developed Tests, Nixon Peabody LLP, https://www.nixonpeabody.com/insights/alerts/2023/10/11/fda-proposes-new-regulations-to-increase-oversight-of-laboratory-developed-tests (last visited Dec 18, 2023).

[3] Center for Devices and Radiological Health, Laboratory Developed Tests, FDA (2023), https://www.fda.gov/medical-devices/in-vitro-diagnostics/laboratory-developed-tests (last visited Oct 11, 2023).

[4] Office of the Commissioner, FDA Proposes Rule Aimed at Helping to Ensure Safety and Effectiveness of Laboratory Developed Tests, FDA (2023), https://www.fda.gov/news-events/press-announcements/fda-proposes-rule-aimed-helping-ensure-safety-and-effectiveness-laboratory-developed-tests (last visited Oct 11, 2023).

[5] Federal Register, supra note 1, at 3.

[6] An introduction to diagnostic testing in laboratories—US, https://www.thermofisher.com/us/en/home/clinical/clinical-genomics/molecular-diagnostics/diagnostic-testing-laboratories-intro.html (last visited Dec 18, 2023).

[7] Federal Register, supra note 1, at 3.

[8] Office of the Commissioner, supra note 4.

[9] Id.

[10] Federal Register, supra note 1, at 19.

[11] Id.

[12] Id. at 8; See also Inside FDA’s Proposed Rule to Regulate LDTs, https://www.thefdagroup.com/blog/fda-proposed-rule-ldt (last visited Dec 18, 2023).

[13] But no earlier than October 1, 2027.

[14] But no earlier than April 1, 2028.

[15] Kezia Parkins, The Theranos saga: a wake-up call for the lab-developed test market, (2022), https://www.medicaldevice-network.com/features/theranos-ldt-regulation/ (last visited Oct 11, 2023).

[16] Id.

[17] Id.

[18] See Office of the Commissioner, supra note 4.

[19] Gregory Levine, Joshua Oyster & Michael Purcell, Regulation Without Legislation: FDA Proposes Rule to Regulate Laboratory Developed Tests and End Historical Enforcement Discretion Policy | Insights | Ropes & Gray LLP, (2023), https://www.ropesgray.com/en/insights/alerts/2023/10/regulation-without-legislation-fda-proposes-rule-to-regulate-laboratory-developed-tests (last visited Oct 11, 2023).

[20] Federal Register, supra note 1, at 2; Center for Devices and Radiological Health, supra note 4.

OIG Issues Favorable Advisory Opinion Confirming the Broad Scope of the Anti-Kickback Statute’s Employment Safe Harbor

By Marki Stewart, Coppersmith Brockelman

In a landmark Advisory Opinion, the U.S. Department of Health and Human Services’ Office of the Inspector General (“OIG”) confirmed its expansive view of the Anti-Kickback Statute’s employment safe harbor this week, providing much-needed clarity on how physicians may be compensated for revenue they generate for their employer.  

In Advisory Opinion 23-07, the OIG considered a request from an employer that operates a multi-specialty physician practice and two ambulatory surgery centers (“ASCs”).  The employer proposed to provide a bonus to each employed physician consisting of 30% of the employer’s net profits from the ASCs’ facility fee collections attributable to that physician’s surgical procedures performed at the ASC.  The employed physicians’ bonus would therefore vary with the volume and value of procedures performed at the employer’s ASCs.  The OIG concluded that the proposed arrangement would fall within the employment safe harbor, and therefore, would not be subject to Anti-Kickback Statute liability.  

The Anti-Kickback Statute prohibits any person from paying or receiving remuneration in exchange for patient referrals covered by a federal health care program (such as Medicare or Medicaid).  Payments that vary with the volume or value of a physician’s referrals are generally considered to be high risk.  However, the Anti-Kickback Statute has a safe harbor for employees, stating that “remuneration” does not include “any amount paid by an employer to an employee, who has a bona fide employment relationship with the employer, for employment in the furnishing of any item or service for which payment may be made in whole or in part under Medicare, Medicaid or other Federal health care programs.”  The employment safe harbor therefore states generally that remuneration does not include payments to bona fide employees; however, the extent of that safe harbor, and whether employees’ compensation may be directly tied to profits from other service lines operated by the employer, was unclear until Advisory Opinion 23-07 was issued.

In approving the proposed arrangement at issue in 23-07, the OIG concluded that the employment safe harbor protected the bonus payments because: (1) the physicians subject to the bonus plan are bona fide employees (as opposed to independent contractors or other types of nonemployees); and (2) the employment safe harbor is broad enough to cover compensation tied to profits the physician generates for a separate service line—the ASCs—owned by the employer.  

The OIG noted, however, that a similar arrangement under a different corporate structure may raise fraud and abuse concerns under the Anti-Kickback Statute.  The OIG goes on to state that an arrangement where “physicians were owners of the ASCs and paid themselves the bonuses contemplated by the Proposed Arrangement as ownership distributions” may raise fraud and abuse concerns.  Indeed, a series of separate safe harbors applicable to ownership interests in ASCs require that payments to physician owners are based on the physician’s investment, not the volume or value of their referrals to the ASCs.  Therefore, physician owners of ASCs still may not receive remuneration that is based on their referrals, unlike employed physicians.

It is important to note that the ASCs were owned directly by the employer’s corporate entity.  If the ASCs were owned by a separate entity (even an entity wholly-owned by the employer), the employment safe harbor would not extend to compensation paid by that entity to the employed physician.    

Advisory Opinion 23-07 is a watershed opinion because: (1) it confirms that the employment safe harbor broadly allows employed physicians’ compensation to be tied directly to volume or value of the business they generate for their employer; and (2) it establishes that the employment safe harbor would cover compensation that is based on facility fee collections from a discrete corporate division of the employer, and is not limited to the employer’s collections for physicians’ professional fees.  Health care employers with multiple lines of service and who receive facility fees (including hospitals) now have clear guidance on how to structure employed physicians’ compensation in a manner that does not violate the Anti-Kickback Statute. 

Telemedicine Controlled Substance Prescribing Rules Continue to Evolve Through Regulatory Sputters

By Kaytie Ravega, partner at Quarles & Brady LLP, with contributions from partner Ted Sullivan and associates Ashleigh Giovannini, Shamika Mazyck, Jacob Pallotta, and Monica Wright, who thankfully watched the DEA listening sessions referenced below in shifts to capture the threads and important points raised by the many speakers on this critical topic.

Introduction to federal law regulating telemedicine controlled substance prescribing, circa 2009 through 2020

It is well known that the Drug Enforcement Administration (“DEA”) requires a prior in-person visit before a healthcare provider may prescribe a controlled substance to a patient during a telemedicine encounter.  This is a component of the Ryan Haight Act (the “Act”), a federal statute that took effect in 2009. Perhaps less familiar, the Act also includes a mandate to DEA to create a way for telemedicine providers to register or have some path to providing controlled substance prescriptions to their patients without the in-person visit requirement.  Developing a registration for telemedicine providers has apparently not been as easy as creating a separate registration number, such as the recently-retired “X” numbers for suboxone prescribing.  Rather, despite multiple instructions from Congress over the past decade, as well as pleas from industry leaders such as the American Hospital Association, DEA has not implemented an option for telemedicine providers to provide care for patients who require controlled substance prescriptions without the in-person visit.  The most recent Covid-19 public health emergency (“PHE”), however, continued to force the issue.

Attempts at regulating telemedicine controlled substance prescribing, circa 2023

During the PHE the in-person visit requirement for telehealth controlled substance prescribing was generally waived, with an express statement from DEA that the requirement would be restored once the pandemic ended. As the PHE rambled toward closure, on February 24, 2023 the Department of Health and Human Services (“HHS”), the Department of Veterans Affairs (“VA”), and DEA issued a Notice of Proposed Rulemaking (the “Proposed Rule”) proposing to permanently extend the PHE telemedicine prescribing flexibilities and requesting public comments on the proposal.  

In May 2023, the DEA published an alert indicating that it received more than 38,000 comments from industry stakeholders regarding the Proposed Rule. Because of this comment volume, the DEA announced the submission of a draft Temporary Rule to the Office of Management and Budget titled “Temporary Extension of COVID-19 Telemedicine Flexibilities for Prescription of Controlled Medications” (the “Temporary Rule”) with an effective date of May 11,,2023. The Temporary Rule authorized providers to continue relying on the PHE telemedicine flexibilities for the prescription of controlled substances through November 11, 2023. Upon that expiration date, the Temporary Rule had stated that the full scope of telemedicine flexibilities will end for new relationships, and only be extended through November 11, 2024 for provider-patient telemedicine relationships established prior to or on November 11, 2023. 

As part of the planning for the Proposed Rule to become effective (once the Temporary Rule ended or at some other time to be determined) and to consider what additional changes may be needed in light of all the comments to the Proposed Rule, DEA hosted a two-day listening session on September 12 and 13, 2023 to empower “healthcare practitioners, experts, advocates, patients, and other members of the public” to voice their support for or objection to the provisions of the Proposed Rule. The stated goal of the listening session was to “receive additional input concerning the practice of telemedicine with regards to controlled substances and potential safeguards that could effectively prevent and detect diversion of controlled substances via telemedicine.”  In other words, DEA and the healthcare community at large face a challenge of competing interests in terms of telemedicine prescribing; specifically, how to support increased access to healthcare through telemedicine while managing the risk of diversion? 

Numerous presenters over the course of the two day event addressed a range of topics related to telemedicine prescribing, discussing:

  • the need for more flexibility, away from the rigidity of the pre-PHE prior in-person visit requirement;
  • concerns about ensuring prescriptions are valid and that provider-patient relationships exist;
  • ensuring that pharmacies are not treated as a gatekeeping substitute for adequate enforcement against rogue prescribers;
  • preventing telemedicine from being an avenue of diversion or fraud to the extent possible; 
  • the critical role of telemedicine in access to care in multiple scenarios where many parts of the U.S. confront provider shortages, including mental health care, behavioral health, and chronic condition management of many kinds; 
  • telemedicine’s effect on patient compliance with care and improved participation in care management, such as showing up for telemedicine visits more reliably and other key examples; 
  • a wide range of proposals for recommended changes, including those who requested prohibiting some specific products or provider types, such as nurse practitioners and physician assistants, from controlled substance prescribing via telemedicine altogether; and
  • whether DEA has a legitimate role in affecting telemedicine practice to the extent clinical care is affected, among many other points both for and against these examples.

In the face of all of this, to consider options and next steps, DEA again adjusted the compliant path.

The Current Rule, circa 2023-2024

Approximately a month after the listening sessions, on October 10, 2023, DEA, jointly with HHS, published a “Second Temporary Extension of COVID-19 Telemedicine Flexibilities for Prescription of Controlled Medications,” (the “Current Rule”).  Note that state requirements may vary from and be more stringent than DEA’s requirements.

The Current Rule extended and renewed the Temporary Rule, meaning that instead of ending on November 11, 2023, the flexibilities for controlled substance prescribing in place during the PHE are now extended through December 31, 2024. Further, the Current Rule authorizes all DEA-registered practitioners to prescribe Schedule II-V controlled substances via telemedicine until December 31, 2024, regardless of whether the practitioner established a telemedicine relationship with the patient prior to or on November 11, 2023. The DEA signaled that the agency chose to extend these flexibilities as it continues to evaluate the information gathered during the two-day listening session and develop new standards and/or safeguards for telemedicine prescribing of controlled medications. Drafters of the Current Rule indicated that DEA anticipates promulgating new rules in the Fall of 2024. 

Specifically, under the Current Rule, and if allowed by applicable state laws, controlled substance prescriptions may be issued during a telemedicine encounter, without a prior in-person visit, only if all of the following conditions are met: 

(1) The prescription is issued for a legitimate medical purpose by a practitioner acting in the usual course of professional practice; 

(2) The prescription is issued pursuant to a communication between a practitioner and a patient using an interactive telecommunications system referred to in 42 CFR § 410.78(a)(3) [a two way, audio video real time encounter];

(3) The practitioner is (i) authorized to prescribe the class of controlled substance specified on the prescription, or (ii) exempt from obtaining a registration to dispense controlled substances; and

(4) The prescription is consistent with all other applicable legal requirements.

See 21 CFR § 1307.41; 42 CFR § 12.1.

A Law and Policy Analysis of Global Comprehensive Sexual Education Programs

By: Samantha Hollinshead, J.D. Candidate, Sandra Day O’Connor College of Law, Arizona State University, and

Jennifer L. Piatt, J.D., Co-Director, Center for Public Health Law and Policy, Sandra Day O’Connor College of Law, Arizona State University

Sexual education has historically focused on disease and pregnancy prevention. In 2009, the United Nations (UN) moved towards a more holistic approach, defining “comprehensive sexual education” (CSE) as (1) “scientifically accurate,” (2) “incremental,” (3) “age-and developmentally appropriate,” (4) “curriculum based,” (5) “comprehensive,”[i] (6) “based on a human rights approach,” (7) “based on gender equality,” (8) “culturally relevant and context appropriate,” (9) “transformative,”[ii] and (10) focused towards development of life skills needed to “support healthy choices.”

Extensive research has indicated that CSE is generally effective in producing positive public health outcomes such as reducing teen pregnancy and HIV rates. CSE is most effective when educators provide accurate information on a range of topics, empowering students to take ownership of their physical and emotional development. Deliberately excluding critical aspects of sexual education, including menstruation, gender identity, and sexual orientation, reduces its overall efficacy, contributes to misinformation, and leads to greater risk-taking, precipitating broader public health implications.

CSE has not been uniformly adopted in the U.S. despite the U.S. having the highest rates of teen pregnancy among industrialized countries, per various studies conducted over the past several decades.[iii] Current law and policy approaches to sexual education in the U.S. resemble a checkerboard of state requirements that do not reflect the UN’s CSE guidance. As described below, the health of American populations may benefit extensively from domestic implementation of CSE programs as compared to other nations. Yet, profound political, social, and legal complications toward this realization exist across multiple U.S. jurisdictions on three key CSE determinants: (1) age limitations; (2) abstinence-only education; and (3) LGBTQ+ inclusivity.

Age and Informational Limitations

Even though providing broad and accurate information makes CSE more effective, some U.S. states are continuing to pass legislation or operate programs that directly limit access to sexual education. Florida’s House Bill 1069, signed by Governor Ron DeSantis in May 2023, expressly restricts health education, including discussions on puberty, to students in 6th – 12th grades. The average age individuals assigned female at birth start their periods is just over 12 years, but some start as early as 8 years. By limiting the age at which health education is taught, individuals assigned female at birth may lack vital information until after they have already begun menstruating. Poor period hygiene can result in the spreading of diseases (e.g., bacterial vaginosis, urinary tract infections, hepatitis B) and long-term reproductive issues, including complications during birth and infertility.

Comparatively, in the Netherlands, CSE starts as young as 4 years of age. Students receive education about their physical development, ways to prevent adverse health outcomes, body image, and healthy relationships, among other topics. Consequently, Dutch teen pregnancy and HIV  infection rates in 2021 were among the lowest in the world among industrialized countries, due partly to incorporating CSE principles into the curriculum at a young age.

Approaches to Combat Misinformation

Abstinence-only sexual education has been proven ineffective in diminishing risky behaviors and contributes to misinformation rooted in stigma and fear-based tactics. Still, according to the Guttmacher Institute, educators in 29 U.S. states, including Arizona, are required to stress the importance of abstinence in sexual education. In 2011, Zambia introduced components of CSE to address the spread of misinformation extending from students receiving inaccurate and outdated guidance online or from family members. Consequently, Zambian health authorities measured a roughly 7% decrease in unintended pregnancies from 2010 and 2019 and a 50% drop in new HIV  infections between 2011 and 2021. Zambia’s program, though, lacks inclusivity of LGBTQ+ individuals, so still does not fully meet the UN’s definition of CSE.

LGBTQ+ Inclusivity

Currently, only eleven U.S. states require sexual education curricula to address sexual orientation inclusively. In fact, Florida, Kentucky, and Louisiana, among other states, have legislatively banned discussions on gender identity or sexual orientation in schools. While some states have not outright banned inclusive sex education, states such as North Carolina require educators to emphasize monogamous heterosexual marriages. Limiting LGBTQ+ students’ access to relevant sexual education further entrenches social stigma and discrimination lending to significant health related repercussions, including sexual violence and unintended pregnancies. Importantly, some states have recently moved in more inclusive directions. In 2019, Arizona eliminated an educational requirement to “promote honor and respect for monogamous heterosexual marriage.”

Estonia was the first post-Soviet Union country to introduce comprehensive sexual education in schools and currently implements a highly regarded CSE program. Estonia’s CSE curriculum, introduced in 1996, was updated in 2011 to include LGBTQ+ individuals. Estonia has experienced a marked  improvement in sexual health indicators since its adoption of CSE, with abortions falling by 37%, sexually-transmitted infections by 55%, and HIV-specific infections by a whopping 89% from 2001 to 2009. 

_____________

International comparisons illustrate the significant public health benefits of CSE among school-age children. Timely, adaptive, accurate, and meaningful sexual education reinforces their physical and mental well-being and helps ensure students can make informed and responsible decisions. While there are myriad legal and political reasons why CSE is not adopted more broadly across the U.S., its uniform implementation could provide similar benefits for American school students burdened with the negative public health consequences of inadequate sexual education.  

The legal information and assistance provided in this document do not constitute legal advice or legal representation. Views expressed in this piece are those of the authors alone.

[i] UNESCO, International Technical Guidance on Sexuality Education (2018), https://unesdoc.unesco.org/ark:/48223/pf0000260770 (finding an educational program comprehensive if it addresses a wide range of sexual and reproductive issues including anatomy, physiology, reproduction, puberty, contraception, menstruation, childbirth, and STIs).

[ii] Id. (defining educational programs as transformative if they encourage development of critical thinking skills and healthy attitudes towards sexual and reproductive health in an effort to foster compassionate citizens).

[iii]Gilda Sedgh et al., Adolescent Pregnancy, Birth, and Abortion Rates Across Countries: Levels and Recent Trends, 56 J. Adolescent Health 223 (2015), https://www.sciencedirect.com/science/article/pii/S1054139X14003875?via%3Dihub;Susheela Singh and  Jacqueline E. Darroch, Adolescent Pregnancy and Childbearing: Levels and Trends in Developed Countries, 32 Fam. Plan. Persp. 14 (2000), https://www-jstor-org.ezproxy1.lib.asu.edu/stable/2648144?origin=crossref.

Extension of COVID-19 Telemedicine Flexibilities for Prescribing Controlled Substances

By: Nikki Hazelett, 2025 J.D. Candidate, Sandra Day O’Connor College of Law at Arizona State University

In early spring, the Drug Enforcement Agency (DEA) and Substance Abuse and Mental Health Services Administration (SAMHSA) issued a temporary regulation that extended specific telemedicine flexibilities that were initially implemented during the federal COVID-19 Public Health Emergency (PHE).

Per this extension, the DEA’s full set of COVID-19 waivers for prescribing controlled substances via telemedicine will remain viable until November 11, 2023. Provided such prescriptions comply with DEA regulations, physicians may continue to prescribe schedule II-V controlled medications through telemedicine without first conducting an in-person medical examination of the patient.

Additionally, the extension grants individuals who formed a practitioner-patient relationship via telemedicine on or before November 11, 2023, a one-year grace period through November 11, 2024, to continue utilizing PHE flexibilities for prescribing controlled medications through telemedicine.

The intended goal of the temporary extension is to prevent lapses in patient care, ensure the accessibility of telemedicine, and allow sufficient time for healthcare practitioners and patients to prepare for future regulations regarding prescribing controlled medications via telemedicine.

Ultimately, the DEA and SAMHSA anticipate enacting a final set of regulations concerning the practice of telemedicine. Until then, the federal government has determined this temporary regulation is “otherwise consistent with public health and safety,” allowing the DEA and Department of Health and Human Services (HHS) time to address the 38,396 public comments received on two previous notices of proposed rulemakings concerning telemedicine.

Legal Authority & Background:

The Ryan Haight Online Pharmacy Consumer Protection Act of 2008 (the Ryan Haight Act) amended the Controlled Substances Act by adding several new provisions regarding the illegal distribution of controlled substances over the internet. The Ryan Haight Act prohibits distributing and delivering controlled substances online without a valid prescription.[1] The Ryan Haight Act aimed to deter the exploitation of controlled substances through “rouge websites” and “online pharmacies” offering medications without a valid physician-patient relationship.

Implemented by the DEA, the Ryan Haight Act requires practitioners to perform in-person medical evaluations before prescribing controlled medications to patients via telemedicine. It also established seven “practice of telemedicine” exceptions, one of which authorizes the Attorney General and Secretary of Health and Human Services to promulgate rules allowing practitioners to prescribe controlled medications without conducting an in-person examination, provided the practice is in accordance with Federal and State law.

DEA & HHS Proposals:

In response to the COVID-19 PHE, the DEA granted temporary exceptions to both the Ryan Haight Act and the DEA’s power to implement regulations, which permitted physicians to prescribe controlled medications through telemedicine without a prior in-person medical examination. 

The DEA put forth these regulations via two published letters in 2020:

  • A March 25, 2020 “Dear Registrant” letter signed by William T. McDermott, DEA’s then-Assistant Administrator, Diversion Control Division; and
  • A March 31, 2020 “Dear Registrant” letter signed by Thomas W. Prevoznik, DEA’s then-Deputy Assistant Administrator, Diversion Control Division. 

Three years later, faced with the impending expiration of the COVID-19 PHE, the DEA and HHS promulgated two notices of proposed rulemakings (NPRMs) on March 1, 2023:

  • “Telemedicine Prescribing of Controlled Substances When the Practitioner and the Patient Have Not Had a Prior In-Person Medical Evaluation” (the General Telemedicine Rule); and
  • “Expansion of Induction of Buprenorphine via Telemedicine Encounter” (the Buprenorphine Rule). 

The proposed rules would establish limited circumstances where a practitioner may prescribe specific controlled medications to patients through telemedicine post-PHE. The agencies expressed a desire to transition seamlessly into post-PHE regulations and ensure patients have reliable access to controlled prescriptions via telemedicine consistent with “public health and safety, while maintaining effective controls against [drug] diversion.”

For example, the General Telemedicine Rule proposed a grace period of 180 days after the expiration of the COVID-19 PHE to extend telemedicine flexibilities to practitioner-patient relationships formed during COVID-19. 

The comment period for the proposed rules ran through March 31, 2023, and generated an astonishing 38,369 public comments. To effectively review these comments, the DEA and SAMHSA issued a temporary extension of PHE telemedicine flexibilities, as discussed above.

Public Response to the NPRMs:

The American Psychiatric Association (APA) was one among many organizations to submit a comment on the NPRMs. Notably, the APA cautioned the DEA from taking “too many steps backwards” and imposing futile restrictions on the practice of telemedicine during an “opioid public health emergency and nationwide mental health and access to care crisis.”

The APA produced five key recommendations that better balanced the DEA’s obligation to prevent drug diversion without restricting individuals’ access to life-saving technology. The recommendations include:

  1. Allowance for referring practitioners to not be DEA-registered.
  2. Reduction in administrative requirements for referring and prescribing practitioners.
  3. Reduction in additional state-based registration requirements.
  4. Removal of clinical decision-making from regulation in these proposed rules.
  5. Clarification of key inconsistencies in the proposed rules.

The American Hospital Association (AHA) also submitted a comment letter to the DEA regarding the NPRMs. The AHA wrote that the exceptions for in-person medical evaluations under the Ryan Haight Act —specifically under the “other circumstances” catch-all— were opportunities for the DEA to build upon policies for the safe administration of prescriptions via telemedicine. However, the AHA felt that the DEA failed to expand upon prior policies and instead created “unnecessarily burdensome” limits to telemedicine that would adversely impact individuals’ access to healthcare.  

Conclusion:

The purpose of this rulemaking is to extend, for a limited period, the telemedicine flexibilities that existed during the federal COVID-19 PHE. Without this temporary regulation, the COVID-19 PHE telemedicine flexibilities for prescribing controlled substances would have expired at the conclusion of the PHE on May 11, 2023. Despite the uncertainty that lies ahead, the DEA and HHS now have time to address the 38,369 comments received in response to the two NPRMs. This extension will hopefully encourage the DEA to explore regulatory alternatives to expand access to telemedicine.

[1]  The term “valid prescription” means a prescription that is issued for a legitimate medical purpose in the usual course of professional practice by-

(i) a practitioner who has conducted at least 1 in-person medical evaluation of the patient; or

(ii) a covering practitioner. 21 USC § 829(e)(2).

Communications Decency Act § 230: A “Serious Threat” to the Public’s Health

By: Emma Smith, Legal Researcher and J.D. Candidate, ASU Sandra Day O’Connor College of Law, and

Erica N. White, J.D., Research Scholar, Center for Public Health Law & Policy, ASU Sandra Day O’Connor College of Law

On July 15, 2021, U.S. Surgeon General Dr. Vivek H. Murth released an advisory on the spread of misinformation during the COVID-19 pandemic, referring to misinformation as a “serious threat” to the public’s health. FDA Commissioner Robert Califf has made similar remarks, stating in April 2023 that misinformation is “contributing to the three- to five-year lower life expectance in the United States compared to similar countries.” While the threat of misinformation to the public’s health is not new, it ascended to unprecedented levels during the pandemic. Consequently, so has the need to address its spread legally — beginning with Section 230 of the federal Communications Decency Act (CDA) of 1996.

COVID-19 and Misinformation

Resulting in the deaths of over 1.1 million Americans, the COVID-19 pandemic represents one of the greatest public health emergencies of all time, as well as a seminal illustration of the negative impacts of misinformation on health outcomes. As reported on NPR on May 16, 2022, one-third of COVID-19 deaths are attributable to unvaccinated individuals, many of whom were concerned about COVID-19 vaccine safety despite little evidence of the same. A 2021 Kaiser Family Foundation study found that 64% of unvaccinated adults reported that they believed or were uncertain as to 4 or more misstatements about COVID-19 which influenced their choice whether to be vaccinated. Online and other sources of vaccine misinformation clearly contributed to hundreds of thousands of preventable COVID-19 deaths.

The Legal Rise of Online Misinformation

In 1995, the New York Supreme Court found in Stratton Oakmont, Inc. v. Prodigy Services Company that an internet service company was liable for defamation. The company did not make libelous statements directly, but rather solely as a “publisher” (and not a “distributor”) of such content. Furthermore, Stratton established that a platform would be considered a publisher by simply policing content.  Concerned that  Stratton and additional cases would discourage media development and sites from policing their content, Congress passed § 230 of the CDA the following year. Specifically, § 230 of the CDA provides legal protection from defamation claims to social media platforms that merely allow or choose not to remove harmful content posted by platform users.

Twenty-five years later, CDA’s applicability remains largely unchanged—a fact that seems unlikely to change based on recent U.S. Supreme Court assessments under the CDA and other laws. In May 2023, the Court issued its opinion in Twitter, Inc. v. Taamneh determining that internet platforms were not liable under the Anti-Terrorism Act for merely allowing users to post content onsite. Such allowances do not equate to “providing substantial assistance” under the Act. In Gonzalez v. Google, LLC, the Court avoided addressing the scope of CDA § 230, finding that the plaintiff’s complaint alleging Google was liable for an ISIS terrorist attack as ISIS utilized Google for advertisements would likely fail under Twitter. On May 30, 2023, the Court denied certiorari in Jane Does No. 1-6 v. Reddit, Inc., declining to rule on whether Reddit is protected from liability for allowing platform users to post child pornography on their site under § 230.

Collectively, the Court’s reticence to rule allows social media platforms such as Twitter, Facebook, and Reddit to continue to be shielded from liability for harmful content published by users of their sites. In turn, the “legal incentives for platforms to respond to digital misinformation on critical health issues” are minimal. While some platforms have issued internal policies to address the spread of misinformation, content creators continue to post misinformation deleterious to the public’s health openly and innovatively via new technology and the developing capabilities of artificial intelligence.

Time to Act

So much has changed since 1996 when CDA § 230 protections were enacted. The dangers of social media have become clearer as evinced during the riot on Capitol Hill on January 6, 2021 and through impacts over years related to human trafficking, suicide and self-harm, and substance abuse. Social media harms may exceed prior perceptions among legislators and the public. Yet, these harms are real, evolving, and escalating. With public health and safety at risk, the time is now to seriously re-evaluate CDC § 230 protections.

The legal information and assistance provided in this document do not constitute legal advice or legal representation. Views expressed in this piece are those of the authors alone.

All Eyes on Web Trackers Part Two

Part Two of a Two-Part Series: Unprecedented FTC Enforcement of the Health Breach Notification Rule

By: Jeanne E. Varner Powell, The Risk Team, Mutual Insurance Company of AZ (MICA)

Part One of this series provided an overview of online tracking technologies, and summarized guidance provided in December, 2022, by the Department of Health & Human Services (“HHS”) Office for Civil Rights (“OCR”) for HIPAA covered entities addressing privacy concerns stemming from the use of online tracking technologies.

This segment will discuss enforcement by the Federal Trade Commission (“FTC”) of the Health Breach Notification Rule related to tracking technologies.

FTC Developments: The Health Breach Notification Rule – Uncertainty Ahead?

HIPAA covered entities are not the only ones that need to be aware of increasing regulatory scrutiny related to online tracking technology. The FTC is ramping up enforcement activity in this area against entities not subject to HIPPA.  Since 2021, the FTC has settled four significant cases involving alleged improper sharing of consumer health information with advertising platforms like Facebook and Google.[i]

In 2021, the FTC settled unfair and deceptive trade practices claims against FloHealth, the developer of the Flo Period & Ovulation Tracker app. The settlement resolved allegations that FloHealth utilized tracking technologies to share consumers’ sensitive health information with third parties for marketing and advertising purposes.[ii] On March 2, 2023, the FTC announced a proposed settlement of similar claims against BetterHelp[iii], an online mental health treatment company. Similar cases could be on the horizon.

Of particular significance, on February 1, 2023, the FTC announced resolution of its first-ever Health Breach Notification Rule (“HBNR”) action.[iv] The Respondent in that case was GoodRx, a digital health platform offering consumers prescription drug discounts and telehealth services. Just a few months later, on May 17, 2023, the FTC settled a second case involving HBNR claims, this time against Easy Healthcare, developer of the Premom Ovulation Tracking App.[v] Allegations from both cases are discussed in more detail below.

The HBNR was enacted in 2009, but until now it essentially sat idle. The Rule applies to certain non-HIPAA covered entities and imposes reporting requirements when there is a breach of individually identifiable health information.[vi] In 2021, the FTC significantly expanded its interpretation of what entities the HBNR covers and what constitutes a breach that triggers reporting requirements.[vii] Organizations not covered by HIPAA that collect consumer health data (or entities that do business with such organizations) should heed recent FTC activity as a sign to stay abreast of FTC communications about the HBNR and work closely with legal counsel to develop a compliance strategy.

Important HBNR Statutory Terms

To understand the significance of recent FTC actions involving the HBNR, knowledge of some of the statutory terms and definitions is essential.

  • The Rule applies to “vendors of personal health records” (PHRs), a “PHR related entity” or a “third-party service provider for a vendor of PHRs or a PHR related entity.” It requires notification of individuals and the FTC following discovery of a “breach of security” of unsecured identifiable health information contained in a PHR maintained or offered by a vendor or related entity. Third-party service providers that discover such a breach are required to notify the vendor or related entity.[viii]
  • A “personal health record” is “an electronic record of PHR identifiable information on an individual that can be drawn from multiple sources and that is managed, shared, and controlled by or primarily for the individual.”[ix]
  • A “vendor of personal health records” is “an entity, other than a HIPAA-covered entity or an entity to the extent that it engages in activities as a business associate of a HIPAA-covered entity, that offers or maintains a PHR.” [x]
  • “PHR identifiable health information” is “individually identifiable health information, as defined in section 1171(6) of the Social Security Act (42 U.S.C. sec 1320d(6)), and, with respect to an individual, information that:
  • Is provided by or on behalf of the individual; and
  • That identifies the individual or with respect to which there is a reasonable basis to believe that the information can be used to identify the individual.”[xi]
  • Under the Social Security Act definition, “individually identifiable health information” means any information, including demographic information collected from an individual that:
  • is created or received by a health care provider, health plan, employer, or health care clearinghouse; and
  • relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual, and
  • identifies the individual; or
  • with respect to which there is a reasonable basis to believe that the information can be used to identify the individual.
  • “Breach of security” means “with respect to unsecured PHR identifiable health information of an individual in a PHR, acquisition of such information without the authorization of the individual.”[xii]

History Behind GoodRx and Premom – Statement of the Commission on Breaches by Health Apps and Other Connected Devices

In 2020, with more consumers utilizing apps and other technology to stay on top of their health, the FTC recognized that “more companies may be covered by the FTC’s Rule.”[xiii] Accordingly, it initiated rulemaking proceedings and sought public input about potential modifications to the Rule’s definitions and scope. For example, it asked whether it should change the definitions of “PHR related entity,” “third-party service provider,” and “vendor of PHRs”. It also asked, “What are the implications (if any) for enforcement of the Rule raised by direct-to-consumer technologies and services such as mobile health apps, virtual assistants, and platforms’ health tools?”[xiv]

In September 2021, with the rulemaking process still ongoing, the FTC reversed course and published the Statement of the Commission on Breaches by Health Apps and Other Connected Devices[xv] (the “Statement”). The Statement announced for the first time, that the FTC would enforce the HBNR against health app and connected device developers as “health care providers”[xvi] and that it would interpret “breach” to include not just cyberattacks but also sharing of identifying health information without consumer authorization.[xvii] Two commissioners wrote dissents. Both criticized the Commission for publishing the statement without first concluding the ongoing rulemaking process that sought input on these very issues. In addition, they faulted the other commissioners for significantly expanding the Rule in conflict with statutory language, congressional intent, and the Commission’s previously published business guidance.[xviii]

The GoodRx Case

In the GoodRx case, the FTC charged that GoodRx engaged in unfair and deceptive practices in violation of the Health Breach Notification Rule and Section 5 of the FTC Act. [xix] The allegations in the Complaint tracked the FTC’s expanded interpretation of the HBNR as set forth in the Statement. For example, the FTC alleged that the unauthorized disclosures of consumers’ unsecured PHR identifiable health information to Facebook and Google via web trackers constituted a “security breach.” In support of its claim that GoodRx was a “vendor of PHRs,” the FTC alleged as follows:

  • The website and mobile apps are electronic records of PHR identifiable information that are capable of drawing information from multiple sources, including:
    • inputs from users;
    • Medication Purchase Data, pricing, and refill information from Pharmacy Benefit Managers;
    • pharmacy information from pharmacies;
    • information about prescribed medications from healthcare professionals (such as the name of a medication prescribed during a telehealth session); and
    • users’ geographic location information from a third-party vendor that approximates geolocation based on IP address.
  • The information is also managed, shared, or controlled by or primarily for the users. GoodRx lets users keep track of their personal health information, including to save, track, and receive alerts about their prescriptions, refills, pricing, and medication purchase history.

In addition, the FTC alleged that GoodRx broke numerous data privacy promises it made to customers including: 

  • Promised users it would never share health information with advertisers or other third parties, yet used various tracking technologies to send sensitive information like users’ medications and health conditions to companies like Facebook and Google for the purpose of targeted advertising campaigns;
  • Promised users that it would only disclose their personal health information for limited purposes, then shared users’ names, addresses, email addresses, phone numbers, and other personal identifiers with advertising platforms; and
  • Promised consumers it would limit how third parties that received the information could use the information yet failed to do so.

Per the settlement, GoodRx will pay a $1.5 million penalty and be banned from sharing user health information with third parties for advertising purposes. In addition, GoodRx will need to obtain affirmative express consent from users before disclosing health information to third parties for purposes other than advertising, require third parties to delete data shared with third parties, restrict its data retention periods, and implement a comprehensive privacy program.[xx]

The Premom Case

According to the FTC’s Complaint, hundreds of thousands of women have input sensitive health information into the Premom app, including period dates and pictures of ovulation test strips the app uses for predicting the next ovulation cycle. Like GoodRx, in Premom the FTC claimed the app’s developer made promises it didn’t keep concerning collection and sharing of this “identifiable health information.” The Complaint alleged violations of both the FTC Act and the HBNR.

To support its claim that the app developer is a “vendor of personal health records,” the FTC alleged:

  • Premom encourages users to upload ovulation tests and large amounts of information to the app;
  • Premom encourages users to connect other apps and products to Premom and permit Premom to import health information from them; and
  • Premom allows users to manage and control the PHR identifiable health information in the app and track their ovulation, menstruation, and other health information.

The FTC further asserted that Premom transferred unsecured PHR identifiable health information to third parties like Google and AppsFlyer without users’ authorization. According to the Complaint, these “breaches of security” occurred for years and Premom failed to make breach notifications required by the HBNR.

Under the terms of the settlement, Easy Healthcare (Premom’s owner and developer) will pay a $100,000 civil penalty and:

  • Retain users’ personal information only as long as necessary to fulfill the purpose for which it was collected;
  • Will not make misrepresentations about its privacy practices;
  • Comply with HBNR notification requirements for any future breach of security;
  • Seek deletion of data it shared with third parties;
  • Notify consumers of the FTC’s allegations and the settlement; and
  • Implement comprehensive security and privacy programs with strong safeguards to protect consumer data.

In addition, in a related case, Easy Healthcare will pay $100,000 combined to Connecticut, D.C., and Oregon for violations of their laws.[xxi]

Proposed Amendments to HBNR

The day after the Premom settlement announcement, the FTC voted unanimously to issue a Notice of Proposed Rulemaking to amend the HBNR.[xxii] The proposed amendments were filed in the Federal Register on June 9 and comments will be accepted until August 8, 2023. Briefly, some of the proposed changes include:

  • Clarify the scope of the rule – Current definitions would be revised, and new definitions added, to clarify the FTC’s position that mobile health apps and similar technologies not subject to HIPAA are covered by the HBNR. With these changes, the FTC hopes to make clear that the HBNR applies generally to online platforms (“…including websites, apps, and Internet-connected devices…” providing health care services or supplies) and that it covers both medical and wellness services.
  • “PHR related entity” definition changes – Revise the definition to clarify that only entities that access or send unsecured PHR identifiable health information to a personal health record (not those that send ANY information) qualify as PHR related entities.
  • Require consumer authorization for sharing – Health apps would need to obtain consumers’ authorization to share their information with third parties and would be mandated to notify consumers in the event information is accessed without such authorization.
  • “Breach of security” definition changes – This definition would be modified to align with the position the FTC took in GoodRx and Premom. It would include unauthorized disclosures to third parties as well as data security breaches, hacking, and other cyber incidents.
  • Expand breach notice and content requirements – Email and other electronic methods could be used to send breach notifications to consumers. Breach notices would need to contain additional information, such as names of third parties who may have accessed information.
  • Penalties – add a new section to the rule that states the penalties (up to $50,120 per violation per day) for non-compliance.

 For more detail, read the Proposed Amendments in full.

FTC publications

For more information on the FTC’s current interpretation of the HBNR, HBNR compliance, and other FTC enforcement activity, consult the following publications:

[i] FTC Press Release (2021, January 13), Developer of popular women’s fertility-tracking app settles FTC allegations that it misled consumers about the disclosure of their health data. https://www.ftc.gov/news-events/news/press-releases/2021/01/developer-popular-womens-fertility-tracking-app-settles-ftc-allegations-it-misled-consumers-about; FTC Business Blog (2023, February 1), First FTC Health Breach Notification Rule case addresses GoodRx’s not-so-good privacy practices. https://www.ftc.gov/business-guidance/blog; FTC Business Blog (2023, March 3), FTC says online counseling service BetterHelp pushed people into handing over health information – and broke its privacy promises. https://www.ftc.gov/business-guidance/blog/2023/03/ftc-says-online-counseling-service-betterhelp-pushed-people-handing-over-health-information-broke; FTC Press Release (2023, May 17), Ovulation tracking app Premom will be barred from sharing health data for advertising under proposed FTC order.https://www.ftc.gov/news-events/news/press-releases/2023/05/ovulation-tracking-app-premom-will-be-barred-sharing-health-data-advertising-under-proposed-ftc

[ii] FTC Press Release (2021, January 13), Developer of popular women’s fertility-tracking app settles FTC allegations that it misled consumers about the disclosure of their health data. https://www.ftc.gov/news-events/news/press-releases/2021/01/developer-popular-womens-fertility-tracking-app-settles-ftc-allegations-it-misled-consumers-about; https://www.ftc.gov/system/files/documents/cases/flo_health_order.pdf.

[iii]FTC Press Release (2023, March 3), FTC to Ban BetterHelp from Revealing Consumers’ Data, Including Sensitive Mental Health Information, to Facebook and Others for Targeted Advertising. https://www.ftc.gov/news-events/news/press-releases/2023/03/ftc-ban-betterhelp-revealing-consumers-data-including-sensitive-mental-health-information-facebook

[iv] 16 CFR. § 318; FTC Business Blog (2023, February 1), First FTC Health Breach Notification Rule case addresses GoodRx’s not-so-good privacy practices. https://www.ftc.gov/business-guidance/blog

[v] FTC Business Blog (2023, May 17), FTC says Premom shared users’ highly sensitive reproductive health data: Can it get more sensitive than that? https://www.ftc.gov/business-guidance/blog/2023/05/ftc-says-premom-shared-users-highly-sensitive-reproductive-health-data-can-it-get-more-personal

[vi] The Rule implements the requirements of the American Recovery & Reinvestment Act of 2009, Pub. L. No. 111-5, 123 Stat. 115, codified at 42 U.S.C. § 17937; see FTC Health Breach Notification Rule summary, https://www.ftc.gov/legal-library/browse/rules/health-breach-notification-rule & Complying with FTC’s Health Breach Notification Rule, https://www.ftc.gov/business-guidance/resources/complying-ftcs-health-breach-notification-rule-0.

[vii] FTC (2021, September 15). Statement of the Commission on breaches by health apps and other connected devices. https://www.ftc.gov/system/files/documents/public_statements/1596364/statement_of_the_commission_on_breaches_by_health_apps_and_other_connected_devices.pdf

[viii] 16 CFR. § 318.3. Vendors of PHRs must notify the media if the breach affects (or is reasonably believed to affect) more than 500 individuals. Id. at § 318.5(b).

[ix] Id. at § 318.2(d).

[x] Id. at § 318.2(j).

[xi] Id. at § 318.2(e).

[xii] Id. at § 318.2(a).

[xiii] Health Breach Notification, Request for Public Comment, 85 Fed. Reg. 31085 (May 22, 2020).

[xiv] Id.; see also Wilson, C. (2021, Sept. 15) Dissenting statement of Commissioner Christine S. Wilson Policy statement on breaches by health apps and other connected devices. https://www.ftc.gov/system/files/documents/public_statements/1596356/wilson_health_apps_policy_statement_dissent_combined_final.pdf

[xv] FTC (2021, September 15). Statement of the Commission on breaches by health apps and other connected devices. https://www.ftc.gov/system/files/documents/public_statements/1596364/statement_of_the_commission_on_breaches_by_health_apps_and_other_connected_devices.pdf

[xvi] The combined statutory definitions of “vendor of personal health records,” “personal health record” and “individually identifiable health information” provide that a PHR vendor subject to the statute is a “health care provider, health plan, employer, or health care clearinghouse.”

[xvii] Id.

[xviii] Wilson, C. (2021, Sept. 15) Dissenting statement of Commissioner Christine S. Wilson Policy statement on breaches by health apps and other connected devices. https://www.ftc.gov/system/files/documents/public_statements/1596356/wilson_health_apps_policy_statement_dissent_combined_final.pdf; Phillips, N.J. (2021, Sept. 15) Dissenting statement of Commissioner Noah Joshua Phillips regarding the policy statement on breaches by health apps and other connected devices. https://www.ftc.gov/system/files/documents/public_statements/1596328/hbnr_dissent_final_formatted.pdf

[xix] FTC Business Blog (2023, February 1), First FTC Health Breach Notification Rule case addresses GoodRx’s not-so-good privacy practices. https://www.ftc.gov/business-guidance/blog

[xx] Id.

[xxi] FTC Press Release (2023, May 17), Ovulation tracking app Premom will be barred from sharing health data for advertising under proposed FTC order. https://www.ftc.gov/news-events/news/press-releases/2023/05/ovulation-tracking-app-premom-will-be-barred-sharing-health-data-advertising-under-proposed-ftc

[xxii] FTC Press Release (2023, May 18), FTC Proposes Amendments to Strengthen and Modernize the Health Breach Notification Rule. https://www.ftc.gov/news-events/news/press-releases/2023/05/ftc-proposes-amendments-strengthen-modernize-health-breach-notification-ruleficnbkvhernjgiddiuhhclrrrjjnuvjuduhdlvhnhttjicdjiubhjfutdiknnnke        

Reminder: Pregnant Worker Protections Started This Week

By: Rubi Bujanda – Gammage & Burnham, PLC

The Pregnant Workers Fairness Act (PWFA) went into effect this past Tuesday, June 27, 2023. 

The PWFA requires employers with 15 or more employees to provide reasonable accommodations to employees and applicants with known limitations related to pregnancy, childbirth, or a related medical condition. Modeled after the Americans with Disabilities Act (ADA), the PWFA uses the same definition of reasonable accommodation and does not require that employers provide accommodations that cause an undue hardship. Like with the ADA, covered employers must participate in the interactive process if they receive an accommodation request from a pregnant worker. The PWFA also contains prohibitions. Employers may not do the following:

  • Require an employee to accept an accommodation without a discussion about the accommodation between the worker and the employer;
  • Deny a job or other employment opportunity to a qualified employee or applicant based on the person’s need for a reasonable accommodation;
  • Require an employee to take leave if another reasonable accommodation can be provided that would allow the employee to continue working;
  • Retaliate against an individual for reporting or opposing unlawful discrimination under the PWFA or participating in an PWFA proceeding; or
  • Interfere with any individual’s rights under the PWFA.

To recover for a violation of the PWFA, an employee must first exhaust administrative remedies by filing a charge with the EEOC. The EEOC started accepting charges under the PWFA on Tuesday, June 27, 2023. For the PWFA to apply, the situation complained about in the charge must have happened on June 27, 2023, or later (although employees can still pursue charges based on Title VII and/or ADA for conduct prior to June 27, 2023).

Next Steps for Employers

  • Remove your old EEOC “Know Your Rights” posters and replace them with the updated version available here: https://www.eeoc.gov/poster.
  • Review your employee handbook and revise accommodations policies to include reasonable accommodations for workers who have known limitations related to pregnancy, childbirth, or related medical conditions.
  • Train managers to recognize situations in which the PWFA applies and consider what reasonable accommodations may be available in the workplace.

The Mifespristone Battle Enters a New Phase

By: Nicholas H. Meza, J.D., M.P.H., Richard Davis, J.D., Theresa DeAngelis, J.D.

On Friday April 21, 2023, the United States Supreme Court granted the application filed by the Food and Drug Administration (“FDA”) and Danco Laboratories, LLC[1] to stay the lower court’s decision in the high-profile mifepristone litigation. The lower court’s decision reversed the FDA’s original approval of mifepristone (issued in 2000) and has created serious obstacles for all entities and individuals involved in the mifepristone distribution supply chain. The Supreme Court’s decision temporarily ensures nationwide access to mifepristone while the merits of the lawsuit are litigated in the Fifth Circuit Court of Appeals. The Fifth Circuit heard oral arguments related to this litigation on May 17th, 2023, and generally expressed sympathy for the parties seeking to limit the sale of mifepristone.

This article provides a summary of mifepristone regulation, the mifepristone litigation, and concludes with implications for entities involved in the manufacture, sale, and dispensation of mifepristone.

I. Background on Mifepristone Regulation

Over 20 years ago, in 2000, the FDA approved mifepristone. The drug blocks the progesterone hormone needed for a pregnancy to continue and is used with misoprostol to end pregnancies through ten weeks gestation. Mifepristone was initially approved under “Subpart H” regulations implemented under the Federal Food Drug and Cosmetic Act (“FFDCA”) to expedite the approval of “new drug products that have been studied for their safety and effectiveness in treating serious or life-threatening illnesses.”[2]

FDA imposed “restrictions to assure safe use” including an in-person dispensing requirement and permitted the drug to be distributed only to prescribers who agreed to dispense it in certain healthcare settings, by or under the supervision of a qualified physician who attested to the ability to accurately date pregnancies and diagnose ectopic pregnancies. Specifically, the restrictions required that mifepristone be used for pregnancies under 50 days gestation, in connection with three in-person office visits,[3] with supervision of a qualified physician, and where all adverse events would be reported. Today, these types of restrictions in connection with FDA drug approval are referred to as Risk Evaluation and Mitigation Strategy (“REMS”).[4]

In 2016, the FDA updated the drug label for mifepristone, expanding use through ten weeks of pregnancy. The FDA also made major changes to mifepristone’s REMS, including: (1) increasing the maximum gestational age at which a woman can use the drug from 49 to 70 days; (2) reducing the number of required in-person office visits from three to one; (3) allowing non-doctors to prescribe and administer the chemical abortions drugs; and (4) eliminating the requirement for prescribers to report non-fatal adverse events from chemical abortion.[5] In 2021, FDA announced “enforcement discretion” to allow mifepristone to be dispensed through the mail during COVID-19. Finally, on January 3, 2023, FDA approved a modified REMS, permanently lifting the in-person dispensing requirement.[6]

II. Mifepristone Litigation

In November of last year, several months after the Supreme Court’s decision in Dobbs v. Jackson Women’s Health Organization,[7] a coalition of doctors and medical associations filed a lawsuit in the United States District Court for the Northern District of Texas to, inter alia, vacate the FDA’s approval of mifepristone, FDA’s 2016 REMS changes, and the 2021 mail order decision.[8]

In essence, plaintiffs argued that the FDA’s approval and subsequent administrative actions with respect to the drug violated the federal Administrative Procedure Act. Plaintiffs argued that: (1) to approve the drug, FDA improperly relied on Subpart H’s accelerated approval because pregnancy is not a life-threatening illness; (2) FDA improperly ignored scientific evidence in approving and setting distribution controls for the drug; and (3) the Comstock Act, an 1873 obscenity law, prohibits the mailing of any medication used for abortion.[9]

In response, the FDA argued, inter alia, that it properly exercised its authority under the FFDCA and applied its scientific expertise when approving and making determinations about mifepristone and that the Comstock Act is inapplicable when the sender of the product intends the product to be used lawfully.

Deciding on plaintiffs’ and FDA’s arguments, on April 7, 2023, Judge Matthew Kacsmaryk issued a preliminary injunction, staying the FDA’s 23- year-old approval of mifepristone.   In his ruling, Judge Kacsmaryk found that a preliminary injunction was appropriate due to the “substantial threat of irreparable harm” arising both from claims that the use of mifepristone is dangerous and that the FDA did not appropriately follow its approval processes in approving mifepristone—notwithstanding that FDA has repeatedly said that the use of mifepristone is safe, effective, and that any adverse effects are a “rarity.”   

Within the hour of this ruling, Washington federal court judge Thomas O. Rice issued an order in a similar case,[10] which directly contradicted the Texas ruling. Essentially, the Washington ruling ordered the FDA to make no changes regarding the availability of mifepristone in 17 states and the District of Columbia which expressly permit the drug’s use for medication abortions.

Mifepristone’s legality was immediately thrown into question in light of the conflicting rulings. The FDA immediately appealed the Texas District Court’s decision to the Fifth Circuit.  The Fifth Circuit stayed the district court’s suspension of FDA’s original approval of mifepristone. But it would not stay the suspension of subsequent updates to the conditions on the drug’s use, which have governed the drug’s distribution for seven years. In effect, the Fifth Circuit’s order permitted mifepristone to remain on the market, but simultaneously made it illegal to send the drug across state lines by eliminating the effective date of the 2016 Major REMS Changes.

The FDA and Danco Laboratories petitioned the Supreme Court for an emergency stay of the district court’s order pending the appeal of the case. The Supreme Court granted the stay of the lower court’s ruling in a short opinion order[11] and sent the case back to the Fifth Circuit for the Fifth Circuit to consider the case on its merits. Thus, the Supreme Court granted the stay of the April 7, 2023 order of the United States District Court of the Northern District of Texas pending the disposition of the appeal in the United States Court of Appeals for the Fifth Circuit and a disposition for a writ of certiorari to the Supreme Court, if such a writ is timely sought. Should the Supreme Court deny certiorari, the stay will terminate automatically. If the Supreme Court grants certiorari, the stay shall terminate upon the Supreme Court’s judgment.

In contrast to the brevity of the majority’s opinion order, Justice Alito wrote a lengthier dissent, finding Danco had not shown that they were “likely to suffer irreparable harm,” in the “presumably short period at issue” where Danco argued primarily that it could not continue to market mifepristone because the drug would be mislabeled, and that distribution could not resume until Danco satisfied certain regulatory requirements. However, according to Justice Alito, this “would not take place, … unless the FDA elected to use its enforcement discretion to stop Danco, and the applicants’ papers do not provide any reason to believe the FDA would make that choice.” Justice Alito cited that the FDA had previously invoked its enforcement discretion to permit the distribution of mifepristone in a way that the regulations then in force prohibited.

As a result of the stay, mifepristone will be available in interstate commerce at least until the Fifth Circuit ruling , which will likely end up before the Supreme Court again.

Most recently, the three-judge panel of the Fifth Circuit heard approximately two hours of oral arguments on May 17th, 2023, including whether plaintiffs could be found to have legal standing by showing they would suffer a real injury if approval of and access to mifepristone remains the same. FDA argued that the plaintiffs waited over two decades after mifepristone’s approval to bring their case. The panel expressed criticism of FDA and sympathy for the plaintiffs generally.

III. Implications

A Fifth Circuit ruling in favor of the plaintiffs would have sweeping effects beyond starkly curtailing or potentially eliminating the availability of mifepristone. Notwithstanding the potential prohibition of patients across the country to access mifepristone, as described by pharmaceutical industry stakeholders in an amicus brief filed with the Supreme Court, “If allowed to take effect, the district court’s decision will result in a seismic shift in the clinical development and drug approval processes, erecting unnecessary and unscientific barriers to the approval of lifesaving medicines, chilling drug development and investment, threatening patient access, and destabilizing the pharmaceutical industry.”[12] Such a ruling would constitute a radical departure from court deference that is given to the scientific and medical judgment of the FDA — the regulatory agency with scientific expertise designated by Congress as the sole regulator of drugs.

This dramatic departure from traditional deference to the FDA ostensibly means that a court can “undo” FDA approval for a drug it “doesn’t like.” For example, the precedent set by such a decision could result in a court undoing the approval of gender affirming drugs/puberty blockers, which are currently being targeted at the state level in the same manner in which abortion-inducing drugs are being targeted.

Pharmaceutical manufacturers could also invoke such a decision as a weapon to challenge FDA approval of competitor drugs. In these ways, the FDA approval process—and medications which are relied on by patients—could be taken off the market due to one judge’s opinion.

Also at issue is whether the Fifth Circuit will apply the Comstock Act to prohibit the mailing of any abortion-inducing drug in the United States. In some respects, such a ruling would provide clarity regarding the legality (or illegality) of interstate dispensing mifepristone, something that mail-order pharmacies and wholesale distributors struggled to monitor as a patchwork of states implement medication abortion bans. On the other hand, should the court rule in favor of the FDA, pharmacies, wholesale distributors and providers will need to continue to monitor state-specific bans and, perhaps, future challenges to such bans as a basis of federal preemption.

Ultimately, the Fifth Circuit has espoused its openness to such a ruling but it remains to be seen whether the Supreme Court would grant certiorari and how the Supreme Court would treat such a ruling. Stakeholders and the public are only left to wait.

[1] Danco Laboratories, LLC is the manufacturer which holds the approved New Drug Application for Mifeprex (mifepristone) Tablets.

[2] 21 CFR § 314.500 et seq.

[3] The first two visits to administer mifepristone and the third to assess any complications and ensure there were no fetal remains in the womb. Specifically, requirements included in-person dispensing by or under the supervision of a qualified physician, dispensing of misoprostol at the provider’s office or clinic, and a follow up visit 14 days later. See generally, https://www.fda.gov/drugs/postmarket-drug-safety-information-patients-and-providers/information-about-mifepristone-medical-termination-pregnancy-through-ten-weeks-gestation

[4] In 2007, the FFDCA was amended to authorize the FDA to require a REMS for a drug if the FDA deems it is necessary to ensure that the drug’s benefits outweigh its risks.

[5] After the generic version of mifepristone was approved in 2019, one unified REMS was issued for both generic and brand name versions.

[6] Also, in January of 2023, the FDA modified the REMS to provide a process for pharmacies to become certified by the manufacturer of the drug to dispense mifepristone. 

[7] 142 S. Ct. 2228 (2022), available at, https://www.supremecourt.gov/opinions/21pdf/19-1392_6j37.pdf

[8] Alliance for Hippocratic Medicine et al. v. U.S. Food and Drug Administration et al., No. 2:22-cv-223 (N.D. Tex. filed Nov.18, 2022).

[9] As a practical matter, the mifepristone litigation as described above applies solely to FDA approval related to brand and generic versions of mifepristone, which are FDA-approved for purposes of inducing a medication abortion. The litigation does not challenge the FDA approvals for other drugs containing mifepristone, such as Korlym, a drug used to treat Cushing’s syndrome.

[10] Washington et al. v. United States Food and Drug Administration et al., No. 1:23-cv-03026 (E.D. Wash. filed Feb. 23, 2023).

[11] Danco Lab’ys, LLC v. All. for Hippocratic Med., 143 S. Ct. 1075 (2023).

[12] See Pharmaceutical Companies et al., Amicus Brief, available at, https://www.supremecourt.gov/DocketPDF/22/22A902/263624/20230414164838799_2023-04-14%20SCOTUS%20Amicus%20Brief%20FINALa.pdf