The SEC has announced settled charges against Becton, Dickinson and Company, a medical device manufacturer known as BD listed on the NYSE, for “repeatedly misleading investors about risks associated with its continued sales of its Alaris infusion pump and for overstating its income by failing to record the costs of fixing multiple software flaws with the pump.” In essence, the company failed to disclose that it needed, but did not have, FDA clearance for certain changes to the software for its Alaris product, sales of which contributed about 10% of BD’s profits. Without those changes, the product was potentially harmful to patients. “Rather than inform investors that these issues heightened the risk that the FDA would limit BD’s ability to continue selling Alaris,” the SEC charged, “BD made misleading statements in its periodic reports about its regulatory risks.” BD agreed to pay a $175 million civil penalty. Companies in the life sciences should take note that this is yet another recent Enforcement action aimed at a life science company’s alleged misleading statements, including hypothetical or generic risks, regarding regulatory (FDA) status; in charges announced earlier this month against Kiromic BioPharma, the SEC alleged that Kiromic had failed to disclose that the FDA had placed both of its INDs on clinical hold. (See this PubCo post.) According to Sanjay Wadhwa, Acting Director of SEC Enforcement, “BD repeatedly painted a misleading picture of its Alaris infusion pump for investors and then doubled down by keeping them in the dark when the device’s issues came to a head with the FDA in late 2019….Public companies have a fundamental duty to accurately disclose material business risks and should expect to be held accountable when they fall short in that regard.”
Happy Holidays!
Background. According to the Order, BD manufactures the Alaris infusion pump, which “delivers fluids, medications, and blood to patients in hospitals throughout the United States. The Order explained that “[i]nfusion pumps like Alaris are Class II medical devices that present moderate to high risk to patients.” Under Section 510(k) of the Food, Drug and Cosmetic Act, prior to marketing and sale of these types of devises, manufacturers are required to obtain FDA clearance, which requires the manufacturer to make a “510(k)” submission demonstrating the safety and efficacy of the device. Significant modifications—alone or in the aggregate—require a new clearance to continue selling the device. The SEC observed, however, that the FDA “may exercise ‘enforcement discretion’ not to bring an enforcement action for devices that require new 510(k) clearance but continue to be sold.”
As alleged in the Order, in 2016, BD’s regulatory experts for Alaris determined that, in light of cumulative changes to Alaris’s software, Alaris needed a new 510(k) clearance. But after commencing that process, they realized that they did not have the necessary data and documentation for the submission. Concerned that generating the necessary data “would delay the release of the new features and disadvantage its competitive position, the Alaris team changed course” and determined to “seek clearance for only certain new features it wanted to commercialize quickly,” not the cumulative historical changes. However, the FDA notified BD that its narrowed submission was inadequate and that it required information concerning previous changes to the software, related data and “BD’s rationale for not submitting a 510(k) application to cover the prior changes.” Given that BD didn’t have the necessary information available, BD withdrew this application in June 2018: it believed that “pushing forward with this 510(k) application posed a ‘High Probability of Regulatory/Compliance Risk,’ which included, among other things, the FDA determining Alaris was ‘adulterated,’ meaning out of compliance and in need of a new 510(k) clearance because of cumulative historical changes to the device.” The company advised the FDA that it would instead pursue a new 510(k) submission that would include cumulative historical changes. However, the SEC alleged, it did not advise the FDA “that it had previously determined those changes necessitated new regulatory clearance. BD continued selling Alaris nonetheless.”
The SEC charged that “BD knew or should have known this presented heightened risk to the company.” That risk was compounded by a “consent decree with the FDA that resulted from longstanding compliance and safety issues with Alaris.” (The decree was already in place when BD acquired the product line in 2015.) According to the SEC, the “consent decree subjects BD’s subsidiary responsible for Alaris to heightened FDA scrutiny concerning its infusion pumps and gives the FDA enhanced authority to take unilateral actions for violations of FDA rules, including limiting its sales of Alaris or even prohibiting sales of the device.” The SEC charged that, under SEC disclosure rules, including the MD&A requirement to disclose material trends and uncertainties, BD should have disclosed to investors—but did not—the “material uncertainty that the FDA would prohibit BD from continuing to sell Alaris without new FDA clearance.” According to the SEC, by at least January 2019, “the risk that the FDA would restrict BD’s ability to sell Alaris was a known uncertainty that would have such a material unfavorable impact if it came to fruition.” However, the SEC alleged, “BD materially misled investors about the company’s regulatory compliance risks relating to Alaris,” including with some hypothetical risk disclosures. For example, in periodic reports, BD disclosed that “the consent decree gave the FDA authority to stop the company from continuing to sell Alaris ‘in the event of any violations in the future.’” There were also statements that BD “had ‘made substantial progress in its compliance efforts’ in connection with the consent decree.” The SEC charged that these “disclosures were misleading given that (i) BD had not obtained the new 510(k) clearance its Alaris team had concluded was required and (ii) the company was unlikely to obtain such clearance in the near future.”
In addition, the SEC charged that, by the end of 2018, many of “BD’s then-executive leadership knew or should have known of significant deficiencies in how the company’s business unit responsible for Alaris had been managing Alaris’s regulatory requirements. They were informed that the business unit’s regulatory experts had concluded in 2016 that new 510(k) clearance was needed for past changes to Alaris, that the business unit had a historical strategy of avoiding FDA engagement and 510(k)s, that there was a need for additional training regarding the quality system relating to Alaris, that the withdrawn submission for new 510(k) clearance had been driven by business decisions instead of regulatory strategy, and that there was a lack of internal transparency and a lack of respect for the regulatory experts within the business unit.”
Moreover, the SEC alleged, without FDA clearance, BD could not implement updates to Alaris’s software that were intended to “fix over 140 software flaws it had found. These issues had varying degrees of severity and risk. BD categorized over 15 of them as presenting risks of the greatest potential harm to patients.” For example, the low battery alarm could cause Alaris, if not plugged in, to shut down, without warning to the clinician, when its battery was depleted. By August 2019, BD was tracking over 200 reports of serious injuries or deaths potentially resulting from issues with Alaris’s software (although subsequent investigation reduced the number to 24 serious injuries). The FDA also advised BD of further issues.
Again, the SEC alleged, BD did not disclose the regulatory risks arising out of these software issues, but instead provided generic, contingent or hypothetical disclosures about “the possibility of recalls, regulatory action, loss of sales, and injuries or other adverse events due to potential product defects or safety concerns.” But in November 2018, the SEC alleged, BD had “explicitly committed to the FDA that it would recall Alaris to remediate the low battery alarm issue, with the result that, at least by fiscal 2019, “BD’s disclosures were materially misleading.”
In October 2019, according to the SEC, BD presented a proposal to the FDA to fix the alarm issue along with hundreds of other software flaws, including 37 presenting risks of the greatest potential harm to patients, while preparing a new 510(k) submission that it intended to file a year or so later. In essence, BD was proposing that the FDA use its enforcement discretion to allow BD to continue to sell Alaris with the new changes in the interim prior to the filing. But the FDA rejected that idea, advising BD that the device was “violative” and that continuing to sell Alaris was “problematic” and “not an acceptable way to proceed.” The SEC charged that “BD understood from the October 31 meeting that the FDA team believed BD should stop selling the current version of Alaris.” BD told the FDA “it would develop a new plan to fix the software issues. Immediately following this meeting, BD ceased shipping Alaris.”
A BD earnings call was scheduled for five days later. The day before the call, the SEC alleged, BD, including its “then-senior management, in consultation with company lawyers, senior internal experts, and executives in various roles—but not the regulatory expert from the business unit responsible for Alaris—agreed” on a new plan, similar to the plan just rejected by the FDA, to resume shipping Alaris with a new software version within three months, but without first completing the regulatory clearance process. “Notwithstanding the concerns raised by the FDA several days prior, BD’s plan assumed the FDA would exercise its enforcement discretion” to allow BD to make the serious fixes and resume sales. Because the software fix was expected to be developed within three months, BD thought that the “revenue impact of the ship hold” would be limited “to just the first fiscal quarter and allow the company to recoup most of that forgone revenue during the remainder of FY2020.”
As alleged by the SEC, on the earnings call, BD described an expected revenue shift from Q1 to later in the year because of some improvements planned for Alaris, part of its strategy of continual enhancements. BD told investors that “it was ‘in discussions with the FDA about the timing’ of the ‘upgrades.’” The SEC charged that “BD’s statements materially misled investors about Alaris’s regulatory status, and the reliability of its financial forecasts.” The SEC claimed that the implication of these statements was that the company was merely enhancing the device as part of a regular process, while the FDA had described the device as “violative.” In reality, BD had stopped shipping Alaris after the FDA team responsible for overseeing the device had expressed significant concerns about its software issues and compliance and referred to the device as “violative.” BD also failed to convey, in the SEC’s view, that the expectation of shifted sales depended on the FDA’s exercise of enforcement discretion, notwithstanding the FDA’s prior reluctance, and omitted discussion of a “substantial risk of a long-term ship hold if, as one of its key regulatory experts believed, the FDA would require BD to obtain a new 510(k) clearance to resume Alaris sales to new customers.” BD also misled investors about its financial results; BD failed to record the estimated $50 million cost of the Alaris recall, with the result that the company overstated its reported operating income for Q4 by 82%.
There’s a lot more to this story as described by the SEC, and you might want to check out the Order itself for more detail. But to summarize the allegations, over the next two months, BD continued to misrepresent the regulatory status of Alaris and the company’s interactions with the FDA in its Form 10-K and at investor conferences—all without informing investors that it had “ceased shipping Alaris to address concerns raised by the FDA about the device, or that its forecasts depended on the FDA allowing the company to resume sales.” The SEC charged that “BD knew or should have known these statements were materially false or misleading,” suggesting incorrectly that BD had fixed the Alaris alarm issues and that BD had FDA clearance to ship. In December 2019, BD finalized the new interim version of its software and resumed sales of Alaris, but without FDA approval. BD advised investors of the resumption of sales but not the absence of FDA clearance. The FDA, upon hearing of the resumption, was none too pleased and advised BD that resumption of sales was “misaligned with our previous conversations regarding your software issues and our mutual agreement that your firm should not be distributing devices to new customers.” BD again stopped shipping Alaris, but, at its January 28 annual shareholders’ meeting, “BD again reaffirmed the FY2020 revenue forecasts that assumed the company would continue selling Alaris without limitation in FY2020.” Yet, the SEC charged, BD understood that this new “ship hold” would “likely have a substantially negative impact on the company’s revenue in FY2020.”
Finally, in February 2020, BD told investors about the ship hold, including that it “would not fully resume selling the device until it obtained clearance from the FDA. That announcement led to a 12% decline in the company’s share price. Following the call, one analyst texted a senior member of BD’s investor relations group, ‘I just can’t even . . . I do not understand what happened here. 10 days ago we heard everything in pumps was ok and back on market and better than expected . . . I’m stunned and have a lot of angry people with pitchforks.’”
Violations. The SEC charged that BD violated 17(a)(2) and (a)(3) of the Securities Act (antifraud re Form S-8), Section 13(a) of the Exchange Act and related Rules 13a-1, 13a-11, and 13a-13, Rule 12b-20 (periodic reports) , Exchange Act Section 13(b)(2)(A) (books and records) and Section 13(b)(2)(B) (internal accounting controls), Exchange Act Rule 13a-15 (disclosure controls and procedures) and Rule 13a-15(e) (internal control over financial reporting).
BD agreed to pay a civil penalty of $175 million, to retain an independent compliance consultant to review and make recommendations, and to adopt the consultant’s recommendations.
