Compliance Today - June 2021

Violating regulations: What’s at stake

A seemingly endless list of regulations and restrictions applies to foreign interactions. Healthcare organizations and individuals could face violations if they are found noncompliant with areas such as:

• Transactions involving unapproved drug development, serums, toxins and antitoxins, pathogens, and genetic elements.

• Selling, sharing, or redistributing data, advanced technologies, and devices to a sanctioned country. Also, unbeknownst to the organization, proprietary information, intellectual property, and technology can be comingled, exchanged, and stolen.

• Speaking and lecture engagements that divulge trade secrets and expose improper payments and nondisclosure practices.

• Research and clinical trial funding, which is at risk of undue influences, ethical breaches, and shadow operations.

Organizations must know their foreign customers and to whom those customers broker, trade, and distribute products.

Violating EAR, exporting and reexporting of medicine or medical devices without license, or knowingly doing business with a sanctioned country can result in steep penalties that could sink an organization or run it aground with authorities. Violators can also have their license revoked and be prohibited from exporting, reexporting, or transferring any items or products. Organizations should follow the December 2019 release^[4] of the Department of Justice’s Export Control and Sanctions Enforcement Policy for Business Organizations to ensure they are compliant and engage in voluntary self-disclosure. According to the Export Control Reform Act of 2018,^[5] criminal penalties can include up to 20 years of imprisonment and up to $1 million in fines per violation, or both. Administrative monetary penalties can reach up to $300,000 per violation, or twice the value of the transaction, whichever is greater.

According to a 2016 order^[6] issued by the U.S. Department of Commerce Bureau of Industry and Security (BIS), Alcon Laboratories Inc., Alcon Pharmaceuticals Ltd., and Alcon Management SA (collectively, Alcon) violated Iranian Transactions and Sanctions Regulations and Sudanese Sanctions Regulations. Alcon engaged in the sale and exportation of medical end-use surgical and pharmaceutical products from a Switzerland subsidiary and reexported the items to Iran and Syria without a U.S. Department of Treasury Office of Foreign Assets Control authorization. Alcon was assessed a civil penalty in the amount of $8.1 million and agreed to comply with other settlement terms set forth by BIS. The maximum possible penalty for this type of violation could have exceeded $138 million dollars.

Building a strong ECP

Building a strong ECP starts with a plan, due diligence, and a team of experts within your organization involved in each step of the distribution process. Management must demonstrate support of an ECP through adequate funding and resources, a devotion to ongoing training, and by fostering a compliance culture through outward expression and commitment. It is worth the investment to ensure the existence of adequate compliance oversight and controls to support the complexities of an ECP. Businesses and organizations should consider designating an international/trade compliance officer dedicated to the development and governance of international transactions and to manage foreign relations for their ECP. This position would provide oversight of all items and devices for export; ensure appropriate compliance for faculty, students, and visiting scholars from foreign countries; and develop education and infrastructure for a robust program.

Organizations should start by determining what products and items they develop and own that may require authorization or license for export and whether any exceptions or factors specific to the transactions apply. An Export Control Classification Number^[7] is a five-character alphanumeric key code used to classify exports. This number can be found in the CCL located on the BIS website. The CCL outlines the licenses, authorizations, and transaction factors necessary to direct organizations to the appropriate license requirements and export regulations.

Export compliance is challenging, and international/trade compliance officers should conduct a comprehensive strategic risk analysis from an export compliance perspective. Specifically, they should identify red flags in their operations and document the risk that revolves around the actual export item; organizational operation activities; and international transactions with customers, faculty, and students.

An international and trade travel policy-and-procedures document provides an outline and guidance for monitoring export and travel activities. Organizations should understand and document their jurisdiction, item classification, and license information and also screen potential customers against the Consolidated Screening List^[8] to identify and help mitigate exposure risk. They should establish clear guidance and contacts for suspected and potential violations and lay a foundation to be proactive in risk-related areas and customer interactions. BIS offers an extensive library of tutorials, videos, and help guides, as well as contact information that organizations may use in determining their licensing and certification needs, complying with export regulations, and identifying gaps for further investigation.

Actions for maintaining compliance

Developing and implementing a healthy ECP is good business practice and ensures that your global trade interactions align with your organization’s goals, improving capabilities that create value. The following are steps to take and key factors to consider in order to maintain compliance:

• Retain export records for five years. Maintaining meticulous export-related records of all transactions and supporting documents for every level of the export process is important.

• Ensure the international/trade compliance officer conducts a baseline assessment with their internal team of experts, looking at distribution processes, supply chain, and inventory control.

• Evaluate assets, systems, processes, procedures, workforce, documentation, and access points to identify gaps for risk in order to develop and implement improvement plans and corrective actions. Include strategic planning personnel, information technology, and other applicable management teams to look for loopholes and areas for a deeper dive and analyses.

• Make a plan that targets high-risk areas, such as how and where data are stored, and the policies that govern data security and privacy. Pay close attention to copy and transfer controls, monitor access to ensure that those controls can sufficiently protect your data.

• Compare the risk assessment to your corporate business goals and align your compliance strategy with those goals and objectives for engaging in the healthcare global market.

• Integrate the ECP into your current compliance training program to keep your workforce informed and aware of the added level of compliance standards they will be expected to learn and perform on a daily basis. An ECP work plan should focus on regular audits and ongoing training to identify and report deficiencies, risks, and gaps in the ECP.

• Apply defined metrics to measure effectiveness against your organization’s policies and procedures, versus actual practices, to identify strengths and weakness in ECP understanding.

• Consider using an unbiased third party to evaluate compliance and the risk associated with your ECP.

Secure trade and distribution practices, coupled with effective export management and compliance programs, can reduce inappropriate export and reexport diversion and ensure that your products and information will support legitimate global trade movement. Your organization should develop a manual outlining the BIS elements of an effective compliance program and consider submitting it to BIS ECP Manual Submission^[9] for a free one-time courtesy review. An up-front investment in a holistic ECP includes a work plan, governance manual, policies and procedures, auditing, monitoring, ongoing assessments, and regular training of all who are “captained” by a compliance oversight structure. This will ensure communication, awareness, and compliance activities meet the demands of the Export Control Reform Act and that your ECP is shipshape and ready to sail.

Takeaways

• Quantify your volume of export items, services, and products.

• Establish policy/procedure that governs export transactions.

• Mitigate gaps in conflict-of-interest procurement process.

• Document investigations.

• Enhance education and training.