Medical device company settles fraud charges with SEC

WHAT HAPPENED

On December 16, 2024, the SEC announced settled charges against Becton, Dickinson and Company for misleading investors about risks associated with its continued sales of one of its key products and overstating its income by failing to record the costs of fixing serious software flaws.

The company agreed to pay a $175 million civil penalty. In addition, without admitting or denying the SEC’s findings, it agreed to cease and desist from violating specified securities laws and to retain an independent compliance consultant to review and make disclosure control recommendations.

TAKEAWAYS

The allegations in the case include multiple instances of management disregarding FDA instructions and the advice of the company’s internal regulatory team. As such, it serves as a reminder of the importance of establishing a healthy tone at the top and culture of compliance.

It also provides lessons for public companies with their routine SEC filings and investor communications. It illustrates the importance of establishing and following effective disclosure controls and procedures, such as:

• Developing a systematic approach for collecting and reviewing relevant information.
• Circulating questionnaires or inquiries to key business units, including regulatory teams where appropriate, and having them confirm material statements within their areas of responsibility.
• Instituting procedures to confirm the absence of any material changes following the inquiry process but before filing the report.
• Assembling back-up and supporting documentation in an appropriate file or binder for each of the various statements made in the report.
• Reviewing press releases, board materials and other sources of information for relevance and consistency.
• Documenting a reasonable basis, with adequate underlying support, for any forward-looking statements.

The SEC Order nowhere addresses or even suggests the origin of the investigation that led to the charges.  Nonetheless, based on the depth and specificity of the allegations, public companies should remain alert to the possibility that their workforces may include potential whistleblowers.  This reinforces the importance of maintaining and fostering strong codes of conduct and cultures of compliance.

DEEPER DIVE

Background

According to the SEC Order:

One of the company’s most profitable and important products -- the Alaris infusion pump -- delivers fluids, medications, and blood to hospital patients. It represented 10% of total operating income in fiscal 2019 and early fiscal 2020.

From 2016 to early 2020, the regulatory team determined the company needed to obtain new regulatory clearance from the FDA to address changes to the device and to fix multiple software flaws that posed safety risks.

Decision not to obtain FDA clearance for device and software changes

• In 2016, the regulatory team determined that Alaris required new clearance from the FDA because of cumulative changes made to the device since its last regulatory clearance.
  • Management decided to seek clearance only for certain new features proposed to be added in the future because the company couldn’t provide the required data to clear earlier software changes.
  • However, the FDA asked the company to provide that same information for the earlier changes and to explain why it hadn’t requested regulatory approval before making those changes.
• As a result, in June 2018, the company withdrew the application and told the FDA it would work on a new submission. Nevertheless, the company continued to sell Alaris until 2020.
• The company materially misled investors by failing to make required disclosures about the increased risk that the FDA would prohibit sales due to software flows that presented risks to patient safety:
  • Following the 2015 acquisition of the Alaris product line, the Alaris subsidiary remained subject to a preexisting consent decree with the FDA subjecting it to heightened scrutiny of its infusion pumps and giving the FDA enhanced authority to take unilateral actions for violations, including limiting or barring sales.
  • The company disclosed in its periodic reports that the consent decree gave the FDA authority to stop the company from continuing to sell Alaris “in the event of any violations in the future.”
  • In its 10-K, the company stated that it had “made substantial progress in its compliance efforts” in connection with the consent decree.
  • However, the company had not obtained the FDA clearance the regulatory team had concluded was required and which the company was unlikely to obtain in the near future.

Misrepresentations about risks in Alaris’s software 

• By 2018, the company had received reports that there had been over 30 deaths or serious injuries potentially associated with software issues relating to defects with the device’s low battery alarm and system error code issues.
• By January 2019, the company had identified over 25 additional software flaws that presented risks of the greatest potential harm to patients. However, the company did not fix any flaws or inform investors of the heightened risk of sales halts.
• In August 2019, the FDA identified and told the company to prioritize two additional alarm issues that presented potential safety risks.
• Even though it was probable that a recall was likely, the company did not disclose the heightened risk of FDA blocking continued sales and did not properly account for costs of fixing the issues.

Proposal to fix software before FDA clearance

• In October 2019, after the FDA raised new concerns about Alaris’s alarms, the company proposed a plan to fix the software issues.
• It also informed the FDA for the first time about the additional flaws it had found, including those now totalling 37 that presented risks of the greatest potential harm to patients.
• It proposed to update the software within a few months and asked for permission to resume selling Alaris.
• Additionally, it proposed to recall existing devices by sending technicians to remediate software in the field over a 3 ½ year period and to file a new application covering the software fixes and historical cumulative changes within somewhat over one year.

FDA rejects company proposal

• The FDA “firmly rejected” the proposal, describing the device as “violative” with “defects and safety issues.” It warned that continuing to sell Alaris was “problematic” and “not an acceptable way to proceed.”
• The FDA stated that the proposed changes required regulatory clearance and that it would not consider a partial submission that did not cover both remedial and cumulative historical changes.
• It also rejected the 3 ½ year timeline and told the company the devices already in medical facilities needed to be recalled and remediated more quickly.

“Risky plan” to ship devices without FDA clearance

• Despite its discussions with the FDA, the day before its November 2019 earnings call, the company instead decided to pursue a plan similar to the one already rejected.
  • Within three months, the company would resume shipping Alaris with a new software version but without first completing the regulatory clearance process.
  • The company assumed the FDA would exercise its enforcement discretion to acquiesce to the software changes so that it could resume sales with new software that fixed the issues presenting risks of the greatest potential harm.

Misrepresentations on earnings call

• On the November 2019 earnings call, the company materially misled investors about Alaris’s regulatory status and related financial forecasts:
  • It asserted that the timing of sales would shift to later in the fiscal year in order to make “some improvements” as part of its strategy to “continually iterate and make enhancements.” In reality, shipments stopped because of significant software and compliance issues.
  • Its forecasts assumed the company would recoup most of the lost sales later in fiscal 2020.
  • The company also failed to record an estimated $50 million in costs related to recalling and fixing the software issues, resulting in an 82% overstatement in Q4 2019 operating income.
• Additionally, the company failed to disclose that its ability to resume sales in fiscal 2020 hinged on the assumption that the FDA would, despite their discussions, exercise enforcement discretion to permit the company to do so.
  • It also failed to disclose the substantial risk that the FDA could require a new submission and clearance to resume sales to new customers, resulting in a long-term hold. 

Continued misrepresentations by the company

• In November 2019, the company decided not to seek FDA discretion to fix all the high risk flaws. As a result, the FDA was even less likely to permit the company to resume sales.
• However, in late November 2019, the company told investors it was “upgrading some software” and that it expected to recoup lost revenue within the fiscal year, despite delays.
• In December 2019, it told investors it expected to gain market share and that the pause in sales would be short-lived.

Material misrepresentations and omissions in 2019 Form 10-K

• The company presented the risks of recalls, lost sales and injuries due to product defects or safety concerns as hypothetical or contingent -- even though Alaris sales were suspended because of FDA objections in light of significant software flaws.
• It failed to disclose the material uncertainty that it might be unable to resume shipping without new FDA clearance.
• It overstated income before taxes by more than 5% by failing to accrue $59 million in estimated remediation costs.
• Management and the disclosure team failed to consult with the Alaris regulatory team involved with FDA discussions.

Resumption of shipping without new FDA clearance; continued misleading of investors

• In December 2019, the company completed updating its software to address some of the issues and resumed regular sales of Alaris, including to new customers, without FDA approval.
• In January 2020, the company told a healthcare conference that it had resumed shipments and reaffirmed its 2020 guidance.
• The company’s statements misled investors by suggesting that:
  • It had fixed the Alaris alarm issues. However, the company hadn’t, because it had determined those fixes required FDA clearance.
  • It had resumed shipping with the FDA’s concurrence. However, this was not the case.

Hold on shipping reinstated; misleading reaffirmation of prior guidance

• In mid-January 2020, the FDA learned the company had resumed sales with software that did not fix key safety issues.
• After the FDA objected, the company reinstated the ship hold on January 23, 2020.
• Even though it did not know how long the ship hold would last, on January 28, 2020, the company reaffirmed the fiscal 2020 revenue guidance originally made in November 2019 when it had expected to fully resume Alaris sales after one quarter.

Investors finally told about need for new FDA clearance

• On its February 6, 2020 earnings call, the company finally told investors about its need to obtain new FDA clearance for Alaris and revised its financial guidance for the full fiscal year.
  • Until FDA clearance, sales would be limited to cases of medical necessity to existing customers with no sales to new customers.
• That day, the stock price fell by about 12%.

Violations and Settlement

The SEC Order found that the company violated antifraud, reporting, internal accounting controls, books and records, and disclosure controls provisions of the federal securities laws.

Without admitting or denying the findings, the company agreed:

• To cease and desist from further violations of those securities law provisions.
• To retain an independent compliance consultant to review and make recommendations concerning its disclosure controls and procedures.
• To pay a $175 million civil penalty.