All posts by Flavio Monfrini

Who’s Who Legal 2018: Our Life Sciences Practice in the Top Three!

Who’s Who Legal just published its 2018 rankings, highlighting the leading practitioners recognized “for their excellent work across the full spectrum of life sciences law”.

Our very own Paola Sangiovanni has been recognized among the top three most highly regarded practitioners in the life sciences legal industry in Italy. Here’s what Who’s Who Legal says about Paola:

«The “fantastic” Paola Sangiovanni at Gitti and Partners is “a truly dedicated life sciences expert”, who is considered “a great deal-maker”. Her transactional expertise in the life sciences space is in high demand, thanks to her “client-focused approach and excellent service”».

We are very proud to share such a terrific achievement with our clients and friends, and we would like to thank you all for your continued support!

New Whistleblowing Legislation Approved in Italy

Whistleblowers will be granted a higher level of protection under new legislation passed earlier this week in Italy.

The new provisions apply to civil servants as well as employees in the private sector. Whistleblowing protection will shield individuals who submit a good faith report concerning unlawful conduct, provided that such report is based on a reasonable belief and factual elements.

The new legislation prohibits any retaliation or other discriminatory measures against good faith whistleblowers, including termination, demotion, transfer or other organizational action.

In the private sector, the new legislation has a significant impact on organizational models adopted to prevent corporate criminal liability pursuant to Legislative Decree 231 of 2001. In fact, all organizational models will need to set up appropriate channels for the confidential reporting of criminal conduct and violations of the organizational models themselves.  Measures aimed at protecting the identity of the whistleblowers and the confidentiality of the reports, as well as disciplinary sanctions against retaliatory or discriminatory measures against whistleblowers, will also need to be included in such organizational models.

The new legislation is expected to enter into force shortly, upon publication in the official gazette.

G7 Health Summit Closed Today in Milan

On November 5 and 6 the G7 Ministerial Meeting on Health was held in Milan. The meeting had an ambitious agenda, ranging from the impact of climate change on people’s health to antibiotic resistance.

According to the Italian Ministry of Health, hosting the summit on the occasion of the 2017 Italian G7 presidency, the meeting innovated in the way matters have been examined and discussed, by using a so called Delphi method based on the opinions of the world’s leading experts.

A number of satellite events have also taken place across the city, including a conference organized by police forces to address the cross-border fight against “pharmaceutical crime” in all its forms, identifying the critical factors and common responses. The conference focused on the strategies and international collaborations needed to crack down on counterfeit pharmaceutical products, as well as the import and on-line sales of unauthorized products.

Another satellite event focused on the employment of new technologies in the healthcare sector, with particular emphasis on sustainability. Antibiotic resistance has also been a key item on the agenda. Italy is among the countries in the world where deaths linked to antibiotic resistance are higher.

Italian authorities did not conceal that one of the hidden goals of the summit was for them to lobby for the relocation of the European Medicines Agency- EMA headquarters to Milan. The political battle among candidate cities is about to get more intense, as a decision is expected to be adopted before the end of November.

More information on the agenda and materials of the summit can be found here: http://www.g7italy.it/en.

Continuing Medical Education: New Rules under Italian Law (and How to Comply with Them)

A new regulation has been enacted in Italy, overhauling continuing medical education regulations. The new provisions will not only have an impact on healthcare professionals, who are subject to educational requirements, but also on pharmaceutical companies and medical devices manufacturers supporting educational events and congresses, as well as on third party providers and organizers. The new regulation has been adopted following consensus among regional authorities and the Ministry of Health on February 2, 2017.

The national commission for continuing medical education is entrusted with the task of determining the requirements and quality levels of educational events, as well as the minimum educational goals applicable nation-wide. The commission shall also adopt a manual for the certification of event organizers (so called CME providers). Regional authorities, on the other hand, must ensure a proper and adequate planning for medical education within their territories.

Furthermore, each professional shall develop and comply with an individualized educational plan (so called “dossier”), in order to ensure a coherent and complete education. Educational events attended abroad may also be recognized for purposes of medical education, in accordance with the criteria that will be established by the national commission.

As far as industry operators are concerned, the new regulation reiterates and strengthens the requirements of transparency and independence of educational providers from pharmaceutical/medical device companies. In particular:

  • CME providers must disclose any relationship between speakers/moderators and any private entity active in the healthcare industry;
  • CME providers must not have any direct or indirect interest in any pharmaceutical/medical device businesses or engage in any relationship with such businesses, other than the sponsorship pursuant to CME regulations;
  • CME providers must not organize any promotional events on specific products; a full segregation of activities between educational CME providers and other event organizers is therefore established;
  • The regulation further expands on the definition of conflict of interests and aims at better regulating all relationships and interests between the industry and educational providers;
  • More stringent provisions concerning advertisement and promotion during educational CME events are introduced, including restrictions for employees of the sponsor to attend educational classes and seminars.

While several provisions of the new regulation directly target CME providers, the industry should also be prepared to the new regulatory framework. Here is a list of what private operators should immediately think of:

  • Train your staff on the new regulations (both at your headquarters and on the field);
  • Check if internal company procedures needs to be updated;
  • Check if internal sponsorship documentation (including contracts) needs to be updated;
  • Review ECM providers with whom you usually work to ensure they comply with the new requirements and avoid conflicts of interests.

Italian Data Protection Authority Authorizes the “Privacy Shield”

The Italian Data Protection Authority has authorized the transfer of personal data to the United States on the basis of the new “Privacy Shield” program, designed by the European Commission and the U.S. Department of Commerce to provide companies with a mechanism to comply with EU data protection requirements when transferring personal data from the European Union to the United States. On July 12, 2016 the European Commission deemed that the “Privacy Shield” offered adequate protection and could enable data transfers under EU legislation.

The Italian Data Protection Authority has now issued a general authorization for the processing and transfer of personal data in accordance with the “Privacy Shield” program and with the European Commission adequacy decision. The general authorization will be published today on the Official Gazette. Italian companies and multinational corporations active in Italy will therefore be able to transfer personal data to United States entities adhering to the “Privacy Shield”.

This latest decision comes after the expiration of the previous general authorization allowing the transfer of personal data to the United States pursuant to the “Safe Harbor” framework, held invalid by the Court of Justice of the European Union on October 22, 2015.

The European Commission plans to implement a continuous monitoring of the “Privacy Shield”, while at the moment it remains unclear how many business entities will seize this opportunity and join in the new program.

Health Data Registries and Surveillance Programs, a New Italian Regulation Steps Up the Game

A new Italian regulation governing health data registries and surveillance programs aims at facilitating the use of such tools for purposes of monitoring health of the population, as well as healthcare spending. A comprehensive legal instrument regulating the various categories of registries and programs was much needed. In fact, the adoption of such a regulation was envisaged by national legislation since 2012 (Section 10 of law decree 179/2012), but no implementing measures has yet been adopted. A draft of regulation has now been released by the Italian government and submitted to the State-Regions conference prior to formal entry into force. The draft has already been reviewed by the Italian Data Protection Authority.

The new regulation aims at standardizing registries and programs adopted over the years, by setting forth: (i) the entities and professionals who may access the information contained in the registries, (ii) the categories of data that are available, and (iii) the measures to be adopted to ensure the security of data in line with data protection legislation.

The goals pursued by the regulation include a better monitoring of diseases at national level and relating treatment, survival rates, mortality index, as well as the increase or decrease over time of a certain disease. The data stored in the registries should also facilitate the carrying out of epidemiological studies in specific territories and/or for specific subsets of the population. Such broad purposes would allow the data to be used in connection with scientific studies, but also for the treatment and prevention of particular diseases.

The data protection provisions enshrined in the regulation are particularly stringent, and provide that all data must be processed by individuals specifically appointed by the data controller and subject to secrecy obligations. Furthermore, the data shall be encoded in a way that does not allow the de-anonymization of the data. Only in case of adverse events and relating field actions, data may be used to contact the interested subject upon prior authorization of the national registry holder. Data breaches will also need to be reported to the Data Protection Authority.

In conclusion, the new regulation provides welcome clarity in a field where regulations have been sporadic and at times incoherent. Moreover, the new regulation seeks to govern at the same time the different legal aspects connected with registries, from healthcare monitoring to data protection. There is little doubt that the hope of the government is to optimize such instruments to better control healthcare spending and conduct a more effective assessment of therapies and products on the market.

 

 

The Safe Harbor Decision (And What Is Wrong With It)

As most people and businesses on either side of the Atlantic are now aware, on October 6, 2015 the European Court of Justice invalidated the Commission’s Safe Harbor decision and made the transfer of personal data to the United States slightly more difficult for businesses.

The Court decision is based on two fundamental findings: first, the Commission’s Safe Harbor decision did not find – as it was required to do according to the Court – that the United States ensures a level of protection of fundamental rights essentially equivalent to that guaranteed within the European Union. Second, and equally important, the Court held that the Commission had no authority to restrict the powers of national data protection authorities to examine complaints of their citizens and assess whether the transfer of data to the United States affords an adequate level of protection.

Until the recent Court decision, the Safe Harbor program has provided a framework for the transfer of personal data from the European Union to the United States. Safe Harbor, however, is neither the only way to transfer personal data to the United States, nor the most commonly used. United States undertakings have consistently used – and will be able to continue to use even after the Court’s decision – model clauses and binding corporate rules.

As European and US undertakings have a wide variety of tools available to transfer data to the United States, the most troubling finding of the Court’s decision is not the invalidation of the Safe Harbor per se, but rather the recognition of much broader powers to member states’ data protection authorities. While the Safe Harbor scheme provided a single and simplified framework that was easily understood by United States’ businesses, the new decision leaves uncertainty as to the approach that each member state’s data protection authorities will take in connection with the export of their citizens’ data. As a consequence, in spite of the current efforts by European authorities to adopt a single data protection regulation ensuring a more uniform legislation throughout the continent, the Court decision is likely to lead – for at least some time – to a more fragmented and less clear legal framework among different member states.

Last, but not least, it is worth noting that one of the main reasons that led the Court to invalidate the Safe Harbor Commission’s decision has been the discovery of mass surveillance programs by US national security intelligence agencies and their rights to access personal data of European citizens. The concern of the European Court of Justice is well grounded and all of us, as individuals, are likely to share that same concern. However, why is the Court not equally worried about the surveillance programs and data retention policies adopted by several member states over the last few years?

Many have pointed out (see for instance here and here) that the Court decision is the result of different sensitivities between US and European people when it comes to the protection of their privacy, being the Europeans more keen to consider the protection of their personal data as a fundamental human right (or, rather, very keen on teaching data protection lessons to the United States). However, the failure of the European Court of Justice to acknowledge that such fundamental right is as much at risk within the borders of Europe as it is outside leaves us wondering whether the Court is really protecting the substance of our privacy as European citizens.

Another September, Another Spending Review.

This is almost becoming a tradition for the national healthcare service in Italy. Comes September… and a new spending review hits the pharmaceutical and medical device industry.

On August 4, 2015 a law decree has been approved by lawmakers, which introduces a number of new mechanisms for monitoring and reining in public spending in the healthcare sector. In particular, the new legislation has introduced several measures:

  • Negotiations with current suppliers of the national healthcare service in order to achieve a 5% reduction in current spending for general supplies;
  • Negotiations with current suppliers of medical devices in order to comply with the spending thresholds agreed upon between the central government and regional authorities;
  • Centralized negotiations with pharmaceutical companies in order to decrease the reimbursement price of products currently reimbursed by the national healthcare service.

While measures aimed at cutting spending in connection with general supplies and medical devices have been entrusted in principle to local authorities and healthcare providers, the national pharmaceutical agency (“AIFA”) plays a central role in the envisaged mechanism to achieve savings for pharmaceutical products. In accordance with the provisions of the new decree, AIFA has indeed conducted negotiations throughout the month of September 2015, with the aim of decreasing overall spending. The new legislation provides the grouping of products in several “clusters” that include therapeutically similar products, regardless of their active principles. The lowest price in each cluster is then used as the reference price for direct negotiations between AIFA and manufacturers.

The new measures also provide that, in case of failure to reach an agreement, reimbursement by the national healthcare service may be withdrawn. However, it is also expressly provided that generic products are not admitted to reimbursement until any patents and supplementary protection certificates of branded products are definitely expired, thus providing the industry with assurances in connection with their protected drugs.

The reiterated attempts by public authorities to renegotiate prices with suppliers appear to clash not only with basic contractual principles (“pacta sunt servanda”), but also with fundamental rules of public procurement legislation. As the government (in fact, almost yearly) demands discounts on existing contracts, reliance on such contracts is affected, along with transparency and open competition in public procurement procedures. The truth is that the need to cut public expenditures is increasingly overriding basic tenets of contracts and public procurement law.

Med Tech and Pharma industry associations have voiced their concerns, while suggesting that efficiency and savings may be obtained by the national healthcare service through internal reorganization processes rather than by demanding additional discounts to suppliers. In fact, if we step aside from the conflicting commercial interests of suppliers (who want to maximize their revenues) and purchasers (who need to minimize their costs), we cannot but note that, again, the government appears to use cost cutting tools that focus on quantity rather than quality. On the contrary, we would expect that more emphasis should be given to Health Technology Assessment and innovation. We surely need to spend less money, but also to spend it more wisely.

Electronic Medical Record: Italian Data Protection Authority Issues New Guidelines

On June 4, 2015, the Italian Data Protection Authority issued new guidelines governing the collection and processing of personal and sensitive data through the Electronic Medical Record.

  • What is an Electronic Medical Record?

A record, kept by a hospital or a healthcare center, containing patients’ clinical history at that specific hospital or healthcare center.

  • Patients’ rights

The guidelines set forth several rights to which patients treated at any hospital or healthcare center are entitled:

  1. Patients are entitled to decide whether the hospital or the healthcare center may store their data through an Electronic Medical Record. If a patient denies his/her consent, physicians will be able to rely only on information gathered during examination and treatment, as well as on information previously conveyed by the patient, if any. Denial of consent will not affect the possibility of being treated at the hospital/healthcare center.
  2. Specific consent is needed for the collection of certain categories of sensitive date, such as HIV infections, abortions, data relating to sexual assault. With respect to such data, patients will have the right to limit access to specific individuals/professionals.
  3. In addition to all rights granted by the Data Protection Code (such as the right to receive confirmation on the existence of personal/sensitive data, to know the origin of the data, the purpose and means of processing, as well as the logic applied to the processing) patients will also be entitled to receive information on each access to their Electronic Medical Record.
  • Hospitals and healthcare centers’ obligations

Hospitals and healthcare centers are required to provide patients with a thorough privacy notice concerning the processing of data through the Electronic Medical Record. Upon patients’ request, hospitals and healthcare centers shall also provide information concerning stored data and access logs to the Electronic Medical Record (including the professional accessing the data, date and time of access) within 15 days of the request. Patients will also be entitled to redact data or healthcare documentation that they do not wish to be included in their Electronic Medical Record.

The Data Protection Authority’s guidelines also address important technical aspects and provide that patients’ healthcare information contained in the Electronic Medical Record shall be segregated from other administrative data. Sensitive data will need to be encrypted. Furthermore, access to the record will be granted only to medical staff involved in the patient’s treatment and any access and processing will be recorded on log files to be kept by the hospital or healthcare center for at least 24 months.

Lastly, the guidelines set forth strict data breach requirements for hospitals and healthcare center, by providing that any data breach or unauthorized access shall be reported to the Data Protection Authority within 48 hours of knowledge of the breach. Failure to report will lead to the application of penalties.

See the Data Protection Authority’s presentation of the new guidelines