Well, readers, we finally have an answer.  Or at least an interim answer.  And, yes, it comes with “guardrails.”  After the July 23-24, 2026, Pharmacy Compounding Advisory Committee (PCAC) meeting left compounders asking whether (and when) FDA enforcement discretion would follow the favorable peptide votes, HHS has announced a limited Interim Policy.  See our previous posts covering the PCAC meetings (here and here).  But keep the champagne on ice: This is conditional enforcement discretion while rulemaking proceeds, not final placement on the Section 503A bulks list.  That final rulemaking could take quite a while, if FDA’s 503A bulk substance rulemaking process is any indicator of the Agency’s timeliness to action.  After 15 years of waiting and since nomination, only six bulk substances have been moved from FDA’s interim 503A list via the required notice-and-comment rulemaking.

HHS Announces Enforcement Discretion

HHS does not intend to take action against a state-licensed pharmacy, federal facility, or licensed physician compounding with a “covered” peptide bulk drug substance (BDS) when all of the Policy’s specified requirements are met.  Appendix A lists the six substances that received the July PCAC’s nod of approval and thus are on FDA’s “Interim Access List”: BPC-157, Epitalon, KPV,  MOTS-c, Semax, and TB-500.

The Policy’s Appendix A alone, however, does not tell the whole story.  Appendix B specifies peptide identities, including amino acid sequence, chemical structure, molecular weight, and molecular formula, and limits routes of administration:

• BPC-157 acetate:  subcutaneous, intramuscular, oral, and topical dosage forms
• TB-500 acetate and MOTS-c acetate:  subcutaneous or intramuscular injectable dosage forms
• Epitalon acetate:  subcutaneous or intramuscular injectable dosage forms dispensed in intermittent courses
• Semax free base:  intranasal use
• KPV acetate:  topical and oral dosage forms

Furthermore, the Policy requires that the only drug delivery device that can be co-packaged or contain the compounded drug is an FDA 510(k)-cleared syringe because “[m]ore complex drug delivery devices introduce additional patient risk.”

And the sourcing requirements also matter.  The original BDS manufacturer must be FDA-registered (as an FDCA section 510 drug establishment) and comply with FDA’s current good manufacturing practice (CGMP) regulations and other FDCA requirements.  In addition, the identity of its physical location must appear on the certificate of analysis (COA) that accompanies the product.

Further, the COA must characterize and identify the substance and include testing consistent with Appendix B, which is more onerous than what compounders currently rely on.  And, if the peptide BDS is obtained “through an FDA-registered repacker, relabeler, or reseller,” that entity must have performed and documented appropriate vendor validation of the BDS manufacturer and validation of the manufacturer’s COA.

The Policy also calls for reporting “compounded products, serious adverse events, and product quality issues” to FDA and to states where the products are compounded and sent (if different).  It is unclear whether FDA wants a report of “products compounded” generally given a straight reading of the Policy.  But serious adverse events and product quality issues are clearly reportable regardless of whether they are considered drug-related; adverse event and quality reports must be reported to FDA’s MedWatch program.  Product reporting includes:

1. Active ingredient and strength of active ingredient per unit;
2. Original manufacturer of the active ingredient, including unique facility identifier

for the manufacturing facility; and

1. Dosage form and route of administration, ingredient and strength, original manufacturer and facility identifier, dosage form, and route.

Labeling must explain reporting procedures and state: “This is a compounded drug product.  Not for resale.”  Products must contain only a single API listed in Appendix A—no peptide cocktails here.

Access Moves Ahead—yet the Evidence Debate Remains

The Policy follows the favorable PCAC votes despite FDA scientists’ concerns about limited clinical safety and efficacy data, against a backdrop of growing experimental peptide demand and a thriving “research use only” (RUO) gray market.

HHS expressly targets that problem: It expects limited compounding under the enumerated safeguards to discourage widespread use of certain RUO peptides supplied by foreign manufacturers and to provide a “more controlled alternative,” advancing “patient choice and freedom while appropriately protecting patient safety.”  It also anticipates that public comments may supply additional evidence for the forthcoming rulemaking.  None of this makes compounded drugs FDA approved, however.

Interim Means Interim

The Policy lasts until a peptide BDS is addressed in a final rule as included or not included on the 503A bulks list.  HHS may revisit the Interim Policy, in whole or in part, if, among other things, a safety signal or product-quality issue arises involving a covered product.  A big unknown is whether states will follow HHS’s  Interim Policy or make their own path.

The takeaway?  This Interim Policy creates a conditional interim pathway, substance by substance and route by route, not a blanket green light for these six drugs.  One last question: Where is FDA on this Interim Policy?  The Policy makes no mention of FDA’s position or perspective at all and is wholly framed as authored by HHS.

On October 22, 2026, the DOJ Civil Division and the Department of Health and Human Services (HHS) announced a six-month pilot program that offers “legitimate American healthcare businesses” a defined path to come clean on potential False Claims Act (FCA) violations, in exchange for a coordinated civil release and a repayment within a set multiplier range. This False Claims Act Self-Disclosure Pilot Program, or FCA SDPP for short, comes on the heels of recent pronouncements from DOJ about prioritizing criminal healthcare fraud enforcement and from HHS about granting CMS parallel exclusion authority; for more detail, see our posts here and here.  The stated goal of this latest self-disclosure program is to allow companies to quickly move forward with a clean slate on civil FCA liability, rather than undergo years of investigation and negotiation. But, as discussed further below, this program has some serious limitations that life sciences companies must consider carefully.

Who is Eligible for FCA Leniency?

Eligibility for companies is broad on paper: healthcare providers, suppliers, manufacturers, payors, and related entities whose items or services are reimbursed, subsidized, or otherwise paid for, directly or indirectly, by HHS federal health care programs can participate. The gating requirement is that the disclosure describe “a potential violation of the FCA previously unknown to the federal government”; if the government already knows about the conduct, the company can still seek self-disclosure and cooperation credit under Justice Manual Section 4-4.112, but it is not eligible for a pilot resolution. Submissions must be filed by 11:59 PM on April 22, 2027, and the protocol requires a detailed written description of the conduct and the laws violated, exhibits sufficient to show how the conduct worked, a description of remediation, financial information adequate for DOJ to calculate the Base Self-Disclosure Repayment, and a certification from an authorized representative.

Is Self-Disclosure Worth the Risk?

For companies that qualify, the benefits package could be meaningful: a coordinated civil release with no factual admissions, no Corporate Integrity Agreement from HHS-OIG, no civil monetary penalties or revocation from CMS, and relief from the need to submit the same conduct separately under the HHS-OIG Health Care Fraud Self-Disclosure Protocol or the CMS Self-Referral Disclosure Protocol. Note that the announcement makes no specific reference to the newly delegated Section 1128(b) exclusion authority to CMS; it only references the CMS authority for revocation of enrollment.  Any company that offers a self-disclosure will need to ensure that there is no remaining exclusion exposure under CMS’s new exclusion authority.

Another key potential benefit is the fixed financial resolution.  The SDPP sets the multiplier at 1.25 to 1.6 times the Base Self-Disclosure Repayment, and weighs factors such as the timeliness of the disclosure, the duration and scope of the misconduct, the involvement of senior leadership, the financial benefit to the company, and whether the conduct was inherited through a transaction and promptly remediated. That is a far more predictable range than the open-ended up-to-treble damages posture companies normally face in FCA negotiations, and it is coupled with the kind of collateral relief (no CIA and no CMPs) that typically takes months of separate negotiation.

Practical Takeaways

For FDA- and DEA-regulated companies, the practical takeaways track the themes we have been flagging the last few months. The April 22, 2027 deadline is a hard cutoff (although the pilot could be extended or even made permanent), and the “previously unknown” threshold means timing will often turn on whether a whistleblower, a data analytics hit, or an existing agency inquiry has already surfaced the issue: a real risk given DOJ’s recent push on whistleblower incentives and the National Fraud Detection Center.

Companies should think carefully about scope: the published materials describe a release for the company under the federal FCA and specified HHS authorities.  The involvement of senior leadership will be scrutinized as part of any resolution through the pilot, and there is no apparent provision for global FCA resolution for individuals.  Moreover, the announcement makes clear that civil FCA resolution does not address potential federal criminal exposure.  If potential criminal exposure exists, the self-disclosure protocol for criminal healthcare fraud trumps this civil pilot program.  Because the FDC Act is a strict liability criminal statute for regulated companies and their responsible corporate officers, the decision tree about whether to disclose to NFED, pursue the civil pilot, or do both, and in what order, requires careful consideration by any company considering participation in these programs.

It is clear that the Administration is simultaneously tightening the enforcement posture and offering a more structured path to resolution; the companies that benefit will be the ones that are actively conducting compliance activities to identify potential violations, promptly assessing the benefits and risks associated with disclosures, and timely making an informed decision regarding appropriate disclosures.

Yes, we know — the O.N. Diagnostics Warning Letter has already been thoroughly covered since FDA posted it on October 6. We waited for the dust to settle, since we think software companies will be living with the implications of this letter for quite some time.

Though posted on October 6, FDA issued the letter to O.N. Diagnostics on September 1, 2026, following a March 12–17, 2026, inspection of its VirtuOst and VirtuOst Vertebral Fracture Assessment (VFA) software products. VirtuOst VFA was originally cleared under K171435 to use sagittal sections of a spine CT to visualize vertebral deformities, classify fracture type and grade, and support physician management of osteoporosis. The letter provides perhaps the clearest perspective on where FDA will draw the line between the kind of software iteration that lives comfortably inside an existing clearance and the kind that requires a new submission — and it is one that will likely not sit well with SaMD manufacturers who have been treating model retraining and architecture changes as internal engineering decisions.

The Warning Letter states that the software is adulterated and misbranded due to the (1) introduction of a new machine learning algorithm, (2) migration from a desktop to web-based architecture, and (3) migration of the underlying technology platform for the reasons provided, in turn, below:

1. “A new model trained on different data, with different architecture, or optimized for a different objective may perform differently across patient populations, imaging equipment types, or clinical settings. This new feature fundamentally changes how the device performs, fails, and affects patients in ways that go beyond what was originally cleared and therefore the feature must be adequately validated.” That framing — change in training data, architecture, or optimization objective — is broad, and it captures essentially every meaningful AI/ML update a sponsor is likely to ship.
2. FDA treated the move from a desktop application to a web-based architecture as a change that introduced “network-exposed attack surfaces, authentication vulnerabilities, and other cybersecurity risks inherent to internet-accessible platforms.” The company itself acknowledged during inspection that the shift expanded its “cyberattack surface area.”
3. A second referenced but redacted technology platform migration required “comprehensive re-verification and re-validation of the entire software codebase, including changes to third-party libraries and dependencies,” and FDA noted that it had not reviewed the device’s Software Bill of Materials (SBOM) or documentation of the affected third-party components.

Perhaps even more interesting than the points above are some of the underlying takeaways of the letter and the implications for AI/ML and SaMD developers.

First, FDA is reading release notes and version-control logs. The Agency cited the “3.0.0 Release Notes dated June 11, 2024” and the “Software Version Control Log” as the evidentiary basis for its determination that a new model had been introduced. Engineering artifacts that developers generate for internal purposes are now part of CDRH’s inspectional record. The real question here is whether information contained in release notes could be used by manufacturers for other purposes, for example, as notifications under 21 C.F.R. Part 806. We suspect that while FDA may make use of release notes to determine whether a new model has been introduced, it would not agree that information provided in the same format would constitute sufficient notice for customer-facing purposes.

Second, FDA seems to be applying a standard for when a new 510(k) may be needed that is not necessarily consistent with the regulatory requirement. FDA is stating that the new feature “may perform differently across patient populations, imaging equipment types, or clinical settings” that must be “adequately validated” and therefore requires a new 510(k). FDA’s guidance, Deciding When to Submit a 510(k) for a Software Change to an Existing Device, recognizes that software validation is required even when a company determines that no new 510(k) is required, yet in this Warning Letter FDA appears to be conflating the need for validation with the need for a new 510(k), a standard that does not otherwise exist.

Third, architecture changes are now independently regulatory. The web migration and the platform migration were each separately sufficient to require a new 510(k), on cybersecurity and verification/validation grounds respectively. As with the second point above, FDA does not seem to be applying the appropriate regulatory standard or posing the questions presented in the guidance used to help companies determine whether a new 510(k) is required. Instead, FDA appears to be applying a table-stakes position that certain changes, regardless of whether they meet the historical threshold for a new 510(k), will now require one.

Taken together, these three points describe a Warning Letter doing considerably more work than enforcing a single clearance. FDA is using an inspection of one company’s release notes and architecture diagrams to write new law on how it will read 21 C.F.R. § 807.81(a)(3)(i) against the entire SaMD industry — and it is doing so in a way that does not obviously track the text of the regulation or the Agency’s own guidance. A manufacturer that has been quietly retraining models, re-platforming to the cloud, or swapping out dependencies on the theory that none of it individually crossed the “significantly affect safety or effectiveness” threshold now has reason to revisit that theory, and reason to wonder what else in its own version history FDA would read the same way.

On October 20, 2026, the Department of Justice unveiled the Fraud Whistleblower Incentive Program (WHIP), formally the National Fraud Enforcement Division Criminal Tip Rewards Pilot Program (the “Program”) — a three-year pilot that pays an up-front reward of $10,000 to $30,000 for tips leading to criminal charges, well before a case resolves through conviction, forfeiture, or appeal. DOJ is relying on its existing statutory authority under 28 U.S.C. § 530C(b)(1)(L) to pay rewards for assistance to the Department, and awards remain entirely discretionary and non-appealable. The Department of the Treasury has committed $25 million to stand up the Program, and tipsters are directed to submit through an intake form at america.gov/fraud (though DOJ reserves discretion to consider tips submitted through other channels as well). For now, the Program is focused on federal health care offenses, with particular emphasis on hospice, home health, day care, and special services fraud.

The headline feature remains the Program’s front-loaded structure: DOJ wants to give tipsters “certainty about the amount and timing” of a reward, rather than making them wait until prosecution. A reward is paid at or around the time charges are filed (meaning an unsealed indictment, information, or complaint), and a tipster can still pursue a larger payout later under other programs, including the Criminal Division’s Corporate Whistleblower Awards Pilot Program.

Who is Eligible for the Payout?

The eligibility criteria matter as much as the headline number. Only individuals — not companies — can submit, and the information must be original, voluntary, truthful, and complete, submitted before DOJ, another law enforcement agency, or a civil regulator makes any related inquiry. Tipsters who meaningfully participated in the reported scheme are excluded, as are current DOJ personnel, their close relatives, and foreign government officials. Notably, the Program also walls off information obtained through attorney-client privileged communications, through compliance, audit, or internal investigation functions, or in connection with legal representation of a client for personal benefit — though limited exceptions apply where disclosure is necessary to prevent ongoing harm or where at least 120 days have elapsed since the information was provided to company leadership. Submissions are confidential, and anonymous tips are permitted only through counsel.

Several additional eligibility and discretion points deserve attention. A tipster who participated in the scheme can still qualify if their role was “plainly among the least culpable of those involved,” but any direct financial benefit outside ordinary compensation is disqualifying. The Department also expressly reserves discretion to deny a reward where the tipster held a senior or decision-making role over the misconduct, contributed to compliance-system failures, built a culture that deprioritized compliance, or received red flags and failed to act.  These factors will matter most to mid-level and senior managers weighing whether to come forward. On the company side, DOJ has signaled it will treat enforcement (or attempted enforcement) of confidentiality or non-disclosure agreements against would-be tipsters as a negative factor in assessing cooperation credit and compliance-program effectiveness, and retaliation against a whistleblower can both erode cooperation credit and prompt stand-alone enforcement action. Each distinct tip is eligible for only one award, and the Department has reserved authority to permanently bar any person who submits frivolous or fraudulent tips.

Why is DOJ Offering This?

The Program traces directly to Assistant Attorney General Colin McDonald’s October 1 Directive 26-12, which ordered the Fraud Division to design programs that “appropriately incentivize whistleblowers to bring forward credible information pertaining to fraud.” That’s the same directive we flagged in our prior post, which prioritizes health care fraud schemes involving controlled substance distribution and Federal Food, Drug, and Cosmetic Act violations. With WHIP now live — and its compliance-function carve-outs raising real stakes for how internal reports are handled — life sciences and health care companies sit squarely at the intersection of DOJ’s narrowed enforcement focus and its newest, fastest-paying incentive for insiders to talk.

What Should Companies Do?

How all this will work out remains to be seen.  One open question is whether reporting criminal violations of the Federal Food, Drug and Cosmetic Act and the Controlled Substances Act will be eligible as “federal health care offenses” (they were included as such in Direct 26-12).  Another is whether this policy will change the filing or litigation practices of relators filing qui tam complaints as whistleblowers under the False Claims Act.  Specifically, how will the Program’s requirement that information “materially add[ ] to the information the Department already possesses” interact with the False Claims Act’s first-to-file bar and public disclosure bar, and how will a WHIP submission impact a later qui tam filing by the same whistleblower.

Finally, the Program certainly will place a new set of pressures on entities receiving internal audits or investigative reports to take prompt action to prevent ongoing harm within 120 days of the report. Life sciences general counsel and compliance officers should expect WHIP to put greater pressure on companies to act quickly upon receipt of an internal report of federal health care fraud violations, and to calibrate internal hotline, investigation, and remediation workflows to this new reality.

On October 1, 2026, FDA’s 2027 fiscal year began and with it the renewal period for device establishment registrations. Companies have until December 31, 2026, to pay the annual registration fee ($13,785), review their current registration information and device listings, and make any necessary updates for the coming year. Failing to properly register and list medical devices is a violation of the Federal Food, Drug, and Cosmetic Act, and can result in civil and criminal penalties.

We can help your company with the necessary registration and listing activities, such as setting up your profile for initial registration, evaluating whether you need to register and what products you need to list, or renewing for the 2027 fiscal year. We can offer predictable flat fee service rates, and provide ongoing updates throughout the year or annual U.S. Agent services.

FDA’s fiscal year (FY) 2027 began on October 1, 2026, at which time the Center for Devices and Radiological Health (CDRH) released its lists of proposed guidance documents it intends to publish or develop during the fiscal year, including:

• The A-list, which identifies guidance documents CDRH intends to publish.
• The B-list, which identifies the guidance documents CDRH intends to publish as resources permit.
• “Under Construction” list, which identifies guidance documents that CDRH intends to develop as resources permit.

FDA includes 17 guidance documents across all three lists for FY 2027, continuing a downward trend in the number of guidance documents included on the annual lists (29 guidance documents in FY 2025 and 20 in FY 2026). Unsurprisingly, this decrease in the number of planned guidance documents coincides with a reduction in the number of guidance documents that CDRH has actually issued in recent years (as we previously blogged about here). Thus far in 2026, CDRH has issued around 20 guidance documents, compared to its average rate of about 40 guidance documents per year observed between 2022 and 2024.

Across the three lists, a major theme is software, artificial intelligence, and cybersecurity, including:

• Marketing Submission and Lifecycle Management Recommendations for Artificial Intelligence-Enabled Device Software Functions (Final)
• Generative Artificial Intelligence-Enabled Conversational Devices for Mental Disorders: Evidentiary Recommendations (Draft)
  • FDA recently issued a discussion paper (which we blogged on here) posing 26 questions to solicit feedback on the regulation of GenAI.
• Policy for Device Software Functions (retitled from “Policy for Device Software Functions and Mobile Medical Applications”) (Draft)
  • Companies frequently rely on the current version of this guidance in regulatory analyses of non-device software or software subject to enforcement discretion; depending on the nature of the revisions, the impact on industry could be significant
• Postmarket Management of Cybersecurity in Medical Devices (Draft)
• Risk Assessment and Evidentiary Considerations for Generative Artificial Intelligence-Enabled Devices (Under Construction)

The heavy representation of these topics reflects the rapid development of the associated technologies, the growing number of such products in development and on the market, and FDA’s effort to keep its guidance current.

Proposed guidance that cuts across device types:

• Predetermined Change Control Plans for Medical Devices (Final)
• Quality Management System Information for Certain Premarket Application Reviews (Final)
• The Accreditation Scheme for Conformity Assessment (ASCA) Program (Final)
  • As we blogged about previously (here), FDA has raised data integrity concerns about certain testing laboratories and encouraged device developers to partner with ASCA-accredited labs to avoid these issues
• Medical Device User Fee Small Business Qualification and Determination (Final)
• Requests for Feedback and Meetings for Medical Device Submissions: The Q-Submission Program (Final)
• Considerations for Selecting a Predicate Device to Support a Premarket Notification [510(k)] Submission (Under Construction)
• Evaluation of Thermal Effects of Medical Devices that Produce Tissue Heating and/or Cooling (Under Construction)
• Select Updates for the 510(k) Program: Evaluating Substantial Equivalence in Premarket Notifications [510(k)] (Under Construction)

The lists also include plans to finalize several device-specific guidance documents whose drafts were released in the last two years:

• Compliance Policy Regarding Premarket and Other Requirements for Certain NIOSH Approved Air-Purifying Respirators (Final)
• Menstrual Products: Performance Testing & Labeling Recommendations (Final)
• Robotically-Assisted Surgical Devices – Premarket Submissions (Final)
• Pulse Oximeters for Medical Purposes – Non-Clinical and Clinical Performance Testing, Labeling, and Premarket Submission Recommendations (Final)
  • Interestingly, the pulse oximeter guidance, the oldest of these drafts (January 2025), is the only one on the B-list; the others are all on the A-list

FDA is accepting comments on the proposed guidance lists through November 30, 2026.  We will continue to monitor CDRH’s progress and report on key guidance as it issues.

On October 14, 2026, HHS Secretary Robert F. Kennedy, Jr. formally delegated to the CMS Administrator the Secretary’s permissive exclusion authority under Section 1128(b) of the Social Security Act, effective immediately.  See Federal Register Notice here.  Section 1128(b) allows the government to prohibit companies and individuals convicted of certain offenses, including violations of the Federal Food, Drug, and Cosmetic Act, from participating in federal healthcare programs that cover pharmaceutical drugs and medical devices.  This new delegation of authority to CMS does not disturb the authority previously delegated to the HHS Office of Inspector General (HHS OIG), which has exercised this authority solo for almost four decades.  Now, CMS and HHS OIG hold co-equal authority to permissively exclude companies from participating in Medicare and Medicaid programs.

Impact to Our Clients

For medical device and pharmaceutical manufacturers, this new power sharpens the risk calculus around False Claims Act resolutions. FCA cases affecting the life sciences industry frequently rest on FDA-regulated conduct — off-label promotion, GMP failures, misbranding or adulteration, speaker-program kickbacks, and failures to report adverse events — and convictions for this conduct map onto the Section 1128(b) grounds for permissive exclusion.

So. Many. Questions.

Historically, companies faced with an FCA settlement secured a release of HHS OIG’s permissive exclusion authority by entering into a corporate integrity agreement (CIA) with HHS OIG.  CMS has never been a signatory to those CIAs, so it is unclear whether a separate agreement is needed, or whether HHS OIG and CMS will collaborate on a single CIA.  Assuming a single CIA, it begs the question of which agency would be responsible for monitoring compliance to the CIA terms, and whether a company would have reporting obligations to both agencies and under what terms.  Another wrinkle is mandatory exclusion authority, which was not delegated to CMS and therefore remains the exclusive province of HHS OIG.  It would be a nightmare scenario for a company to be stuck between HHS OIG insisting on mandatory exclusion, while CMS argues that permissive exclusion is warranted.

What to Watch

Life sciences companies facing FDA enforcement or qui tam exposure should watch for guidance coming from CMS and HHS OIG clarifying the coordination and collaboration activities between these two offices.  In the meantime, companies engaged in pending government investigations should revisit current settlement strategy, CIA scope, and reserved-rights language.

FDA’s new Rare Disease Framework Initiative is a thoughtful, ambitious, and laudable effort to build a regulatory structure that systematically supports rare disease therapeutic development and review. Detailed in the October 2026 white paper, A New Framework for Rare Disease Review, the initiative is led by the Rare Disease Innovation Hub in partnership with the Office of the Commissioner, CDER, and CBER, with engagement from CDRH and other relevant offices.

Its central promise is to make fit-for-purpose evidentiary expectations the norm for rare disease applications. FDA intends to build a framework in which advice and decision-making are consistently tailored to the evidence reasonably attainable given the disease, its onset and progression, the patient population and its needs, and the investigational product – and clearly communicated throughout development and review.  We hope this means sponsor-FDA discussions will begin with an open consideration of the approaches appropriate to the disease and product, rather than presumptions favoring conventional development sequencing, randomized controlled trials, or traditional statistical thresholds that sponsors must then seek to rebut.

Building a Structure for Consistency

A longstanding concern for patients, developers, and those of us who advocate on their behalf is uncertainty about how FDA applies regulatory standards across review divisions, product centers, therapeutic modalities, and disease areas. HPM’s research has documented FDA’s use of tailored approaches over decades (see here), and we continue to highlight recent examples (see here). This initiative provides an opportunity to make that practice systematic across the Agency.

The initiative therefore seeks to go beyond articulating an approach. FDA proposes to examine policies, procedures, programs, guidance, regulations, and organizational practices to build a durable regulatory structure. Its scope extends from pre-IND engagement through post-approval obligations, includingwhat has become an increasing pain point in chemistry, manufacturing, and controls (CMC) and pre-approval inspections.

A central component is coordinating and consolidating rare disease review expertise across CDER and CBER, supported by shared resources, institutional knowledge, and training. In our view, this could represent a “Rare Disease Innovation Hub 2.0”: translating the experience of existing programs into a structure that consistently informs development advice and regulatory decisions across the Agency.  We hope the Hub can play a role in implementing that framework.

Of particular note, FDA states it will consider revisions to regulations to embed fit-for-purpose evidentiary standards into the foundation for rare disease review. Currently, FDA draws concepts of flexibility from the regulatory framework but relies on guidance, which is non-binding and subject to change, to define that flexibility. Regulations expressly establishing a tailored approach as the default could provide a more durable and predictable foundation for its consistent application.

Guidance and training would then translate that foundation into practice, with guidance better suited to address specific methodological considerations as science evolves. FDA anticipates systematically reviewing guidance and potentially issuing new or revised guidance addressing endpoints, statistical approaches, trial design, patient engagement, external expert consultation, and post-approval obligations, with training to support consistent implementation by reviewers.

From Case-by-Case Flexibility to Regulatory Certainty

The initiative reinforces an important distinction: tailoring the application of regulatory standards to rare disease circumstances preserves the statutory requirements for safety and effectiveness. FDA seeks to use scientific advances, innovative methods, disease expertise, and patient perspectives to identify evidence that can meet those requirements.

We have long championed appropriate flexibility in FDA’s application of the legal standards for approval. We have also raised concerns about the pressure that reliance on an imprecise concept of flexibility places on reviewers and leadership: it can leave FDA staff feeling that they are being asked to “color outside the lines.” A clearly articulated regulatory structure, reinforced through guidance and training, could provide a firmer foundation for applying those same standards to the realities of rare disease development.

If FDA achieves its goals of clarity, consistency, and predictability, appropriately flexible approaches could become a dependable default in rare disease development and review. That would provide greater regulatory certainty about how evidence should be generated and evaluated. Such certainty could encourage greater interest and investment in rare disease programs by making feasible development pathways easier to anticipate and pursue.

What Happens Next?

FDA plans a public meeting (to be held on October 28), a Federal Register request for information, sector-specific roundtables, and internal reviewer feedback sessions to inform the framework’s development. We commend this thoughtful approach to engage both external stakeholders, but also internally to ensure the framework incorporates the experiences and insights from review staff.

HPM’s perspective on that effort is informed by more than a quarter-century of engagement with the rare disease community, including service on the boards of the RARE Foundation (formerly the EveryLife Foundation for Rare Diseases), NORD, and IndoUSrare.  Our work has included involvement in more than one-third of new chemical entity approvals for rare conditions and more than half of accelerated approvals outside oncology, as well as organizing more than two-thirds of Externally-Led Patient-Focused Drug Development meetings. Across these efforts, we have seen the importance of bringing patient perspectives, disease expertise, and appropriately tailored evidentiary expectations into regulatory decision-making.

That experience reinforces our support for FDA’s commitment to build a structure that makes these practices systematic. We look forward to working with the Rare Disease Innovation Hub and its Director, Amy Rick, alongside patients, patient organizations, sponsors, researchers, investors, and other stakeholders to help establish a framework that provides greater regulatory certainty and advances the development of much-needed therapies.

Folks often confuse soundalike terms “biennial” and “biannual” with one another.  “Biennial” refers to every two years while “biannual” means twice a year.  Drug Enforcement Administration (“DEA”) regulations require registrants after taking an initial inventory of all controlled substances on-hand to take a “biennial” inventory on any date within two years of the previous initial or “biennial” inventory date.  21 C.F. R. § 1304.11(c).  The agency holds its ever-popular “biannual” National Prescription Drug Take Back Day each spring and autumn.

In a Marlin Perkins pivot, speaking of National Prescription Drug Take Back Day, DEA and its law enforcement partners will again host local drop-off locations nationwide for safe disposal of unneeded medication on Saturday, October 24th, from 10:00 a.m. to 2:00 p.m. local time.  Last April DEA and its partners collected over 640,000 pounds, or 321 tons, of unneeded medication, at over 4,400 collection sites nationwide during the last Take Back Day.  DEA has collected over 21 million pounds, or 10,500 tons, of unneeded medication since 2010.  Additional information about Prescription Drug Take Back Day, including disposal locations, can be found at: https://www.deadiversion.usdoj.gov/drug_disposal/takeback/takeback.html.  DEA’s Diversion Control website also lists permanent year-round drug disposal locations and provides other disposal information.

So registrants conduct controlled substance inventories “biennially” and the public drops off unneeded prescription drugs “biannually.”

For the third time in this Administration, DOJ is directing its prosecutors to “take an aggressive, all-tools approach to investigating and prosecuting” certain categories of fraud.  Unfortunately, the health care and life sciences space has been singled out, and remains solidly in the crosshairs for white collar enforcement.

In May 2025, Assistant Attorney General Matthew Galeotti of the Criminal Division issued a memorandum listing 10 areas of white-collar crime that DOJ should prioritize.  That list included as number 1, “health care fraud,” and number 8, “[v]iolations of the Controlled Substances Act and the Federal Food, Drug, and Cosmetic Act (FDCA).” Then in April 2026, DOJ issued its first-ever Department-wide Corporate Enforcement and Voluntary Self-Disclosure Policy (CEP) (see what we wrote about and what it means for FDA- and DEA-regulated companies).  And just last week, on October 1, 2026, Assistant Attorney General Colin M. McDonald, head of the Department’s National Fraud Enforcement Division, issued Directive 26-12: Corporate Enforcement in the Fight Against Fraud, that identifies just four areas that prosecutors should prioritize for corporate investigation.  The key takeaway for our clients: health care fraud, drug diversion, and Federal Food, Drug, and Cosmetic Act violations now headline DOJ’s narrowed list of enforcement priorities.  We routinely handle internal investigations into alleged violations of these laws and regulations for the FDA- and DEA-regulated industry, and we are well-prepared to advise on the predicted expansion of corporate prosecutions for this underlying conduct.

What’s New

1. Centralized oversight. All Criminal Division corporate fraud matters now route through the Division’s Corporate Enforcement Section, and Fraud Division prosecutors must notify the Corporate Enforcement Section of new corporate investigations or major developments in ongoing corporate cases.  The Corporate Enforcement Section is also tasked with primary responsibility for any post-resolution compliance monitoring.
2. Health care and drug enforcement is priority one. Of the four listed priorities, health care fraud, controlled-substance distribution, and Federal Food, Drug, and Cosmetic Act violations come first, ahead of government procurement fraud, revenue evasion, and trade/tariff fraud, a direct signal that FDA- and DEA-regulated companies top the Division’s target list.
3. Ten weighting factors. Prosecutors must give “great weight” to ten listed factors when determining whether to bring charges or negotiating plea or other agreements. Relevant factors include management’s knowledge of the scheme, efforts to conceal the scheme from regulators, conduct lasting three-plus years, multi-district conduct, and losses of $25 million or with 25+ victims, among others.
4. Whistleblower incentives. The directive again pushes for policies rewarding whistleblowers, including participants in the misconduct, paired with expanded data analytics through the National Fraud Detection Center.

Why It Matters for Our Clients

Directive 26-12 does not change the CEP itself; it tells prosecutors how to apply it, with health care, drug diversion, and FDA regulation front and center. For pharmacies, distributors, manufacturers, and health systems, several weighting factors, especially multi-year conduct, multi-district reach, and loss or victim thresholds, are the kind of facts that routinely arise in health care fraud and diversion investigations. Companies should assess early whether they have engaged in conduct that implicates these factors, as that shapes both resolution leverage and the self-disclosure calculus.

As we noted in April, the CEP’s core path to the best outcome remains voluntary self-disclosure, full cooperation, timely remediation, and the absence of aggravating circumstances. With the Division emphasizing whistleblower tips and data analytics, misconduct is more likely to reach DOJ from a source other than the company. Companies already subject to FDA or DEA reporting obligations should keep asking whether an internally identified issue warrants escalation to a voluntary self-disclosure before DOJ hears about it elsewhere.

We will continue to track how the Corporate Enforcement Section applies this directive to health care and controlled-substance matters, and we are happy to discuss how it bears on your company’s facts.

On September 21, 2026, the U.S. District Court for the Northern District of Georgia handed the regenerative medicine industry a significant win, vacating two key FDA determinations regarding MiMedx Group, Inc.’s wound-care product AXIOFILL. The decision, MiMedx Group, Inc. v. FDA, No. 1:24-cv-01287 (N.D. Ga. Sept. 21, 2026), addresses foundational questions about how FDA evaluates whether a human cell, tissue, and cellular and tissue-based product (HCT/P) is “minimally manipulated,” and whether the Agency can classify a product as a biological product when it has treated materially similar products as medical devices. Especially because FDA recently lost a similar case before a different district court, Vitti Labs, LLC v. FDA, No. 25-cv-011 (W.D. Mo. Mar. 18, 2026), motion to alter or amend judgment denied (Aug. 28, 2026), the ruling carries potentially broad implications for manufacturers of HCT/Ps, particularly those derived from placental tissue, as it would constrain FDA’s analytical framework and demand consistency in the Agency’s biologic vs. device classification decisions.

AXIOFILL is a dry powder made from extracellular matrix (ECM) isolated from donated human placental tissue, processed through soaking, rinsing, cutting, and grinding, and applied to wounds as a structural scaffold to support new cell growth. MiMedx submitted first a pre-request for designation (RFD) and then a formal RFD requesting classification of AXIOFILL as a “361 HCT/P” (a human cell/tissue product subject to less stringent regulatory requirements). Under FDA regulations, an HCT/P qualifies for the lighter-touch 361 HCT/P pathway only if it meets four criteria, including that it is “minimally manipulated” and intended for “homologous use.” See 21 C.F.R. § 1271.10. Importantly, 361 HCT/Ps are exempt from FDA’s premarket review requirements, and instead are regulated solely under section 361 of the Public Health Service Act and FDA’s 21 C.F.R. Part 1271 regulations.

FDA found that AXIOFILL failed the minimal manipulation criterion because its manufacturing process altered the placental disc’s original ability to function as a selective barrier between fetal and maternal circulatory systems, and separately, in a footnote, suggested AXIOFILL also did “not appear to meet” the homologous use criterion.  After receiving FDA’s initial pre-RFD response, MiMedx submitted its RFD which challenged FDA’s conclusion that AXIOFILL was not minimally manipulated, asserting that FDA focused on the “wrong unit of analysis” by evaluating the whole placental disk instead of considering whether the placental disk tissue ECM was minimally manipulated; and by looking only to the placental disc’s “selective barrier” function in the donor, rather than its “ECM function for structural support” relevant to its use in a recipient.  FDA held its course and in response to the RFD concluded that AXIOFILL failed the minimal manipulation criterion.  FDA further concluded AXIOFILL was a “biological product” because it is comprised of ECM proteins intended to treat injured skin through chemical action, rather than a device (which must not work through chemical action in the body).

MiMedx filed suit under the Administrative Procedure Act (APA) on March 25, 2024, arguing that FDA’s classification decision was arbitrary and capricious and contrary to law. It was undisputed that AXIOFILL is an HCT/P; the dispute was whether it should be classified as a 361 HCT/P, a biological product, or a medical device. In addition to challenging FDA’s “minimal manipulation” determination, MiMedx argued FDA’s biological-product classification was arbitrary because FDA had classified numerous similar ECM scaffold wound products as medical devices despite comparable composition and function.

Applying the Kisor v. Wilkie framework for reviewing an agency’s interpretation of its own regulations, the court held that the “minimal manipulation” analysis must start with the original, unprocessed placental disc tissue rather than the post-processed ECM, rejecting MiMedx’s argument that the isolated ECM was the correct unit of analysis. However, the court found FDA misapplied the “relevant characteristics” prong: it held that the regulation requires assessing whether original tissue characteristics “relevant . . . to the tissue’s utility for reconstruction, repair, or replacement” in the recipient —not solely its function in the donor, such as the placental barrier function—were preserved, and vacated and remanded FDA’s minimal-manipulation determination on that basis. In doing so, the court agreed with the Vitti Labs court that FDA cannot look only to whether a “relevant characteristic” of the donor tissue alone was altered (in that case, the umbilical cord’s function as a conduit for blood flow between a mother and fetus; and on which issue the court also vacated and remanded an FDA RFD decision).

On the homologous-use footnote, the court held that FDA’s brief, four-sentence footnote observation did not constitute “final agency action” reviewable under the APA, since it neither marked the consummation of the Agency’s decision-making nor determined legal rights, so that issue was not before the court.

On the device-versus-biologic question, the court found FDA classified AXIOFILL differently from materially similar ECM scaffold products that had been classified as medical devices, without providing a reasoned explanation or record evidence justifying the disparate treatment, rendering that determination arbitrary and capricious.

Therefore, the court vacated and remanded both FDA’s determination that AXIOFILL is not minimally manipulated and its determination that AXIOFILL is a biological product rather than a device, directing FDA to reconsider both issues consistent with the order.

If left undisturbed, the MiMedx decision marks a meaningful check on FDA’s discretion in classifying HCT/Ps. By requiring the Agency to evaluate “relevant characteristics” in terms of a tissue’s utility in the recipient rather than its original function in the donor, and by requiring FDA to explain its seemingly inconsistent treatment of materially similar ECM scaffold products, the court has significantly altered the analytical framework the Agency may use going forward. On remand, FDA must revisit both its minimal-manipulation finding and its biological-product classification in light of these constraints. (And while not required by the court, it is also possible that on remand FDA will attempt to formally apply the “homologous use” prong as a different avenue to finding AXIOFILL not to be a 361 HCT/P—something FDA did not do the first time around, but in its briefing telegraphed it may want to on the second try).

FDA has not yet indicated whether it will appeal this decision; it has two months from the decision to decide. FDA also has about a month left to decide whether to appeal the Missouri court’s similar Vitti Labs decision.

The upshot of these decisions is that they could herald a real expansion for products that fall under the 361 HCT/P framework, as FDA could no longer rely on a relatively narrow understanding of a “relevant characteristic” of tissues’ function in the donor to find they are more than “minimally manipulated” in a resulting HCT/P.  Similarly, MiMedx could mark greater scrutiny of FDA’s device-versus-biologic classifications more broadly.  HPM is closely monitoring any appeal and/or remand proceedings for these cases, and advising HCT/P manufacturers on the impact of the current state of the litigation on their products.  We can support companies who have received similar adverse classification decisions to develop strategies for potentially challenging those earlier outcomes.

The Controlled Substances Act (“CSA”) and Drug Enforcement Administration (“DEA”) regulations mandate legitimate handlers of controlled substances to obtain a DEA registration, create and maintain certain controlled substance records and reports, and implement effective security to guard against diversion.  The underlying purpose of those requirements is to ensure controlled substance accountability by registrants.

High profile, large-scale hospital and healthcare system employee diversion has been a recent theme in our FDA Law Blog posts (here and here).  A number of common deficiencies were present in most or all of those cases.  And while the cases involve hospital and healthcare diversion, the deficiencies are also found in employee diversion from pharmacies, physicians, dentists and veterinarians.  The common deficiencies for employee hospital diversion cases include:

• The failure to maintain on a current basis complete and accurate controlled substance records for two years in violation of 21 C.F.R. §§ 1304.21(a) and 1304.04(a);
• The failure to conduct a full physical inventory at least once every two years in violation of 21 C.F.R. § 1304.11(c);
• Deficient recordkeeping contributing to the failure to monitor, detect and report employee diversion;
• The failure to report thefts and significant losses to DEA (and the states) in writing within one business day of discovery followed by a DEA Form 106 in violation of 21 C.F.R. § 1301.76(b), impeding timely investigation;
• The failure to adhere to internal controlled substance policies and procedures already in place;
• The lack of effective oversight by management of employees with controlled substance responsibilities and access;
• Inadequate and ineffective controls and procedures to guard against theft and diversion in violation of 21 C.F.R. § 1301.71(a);
• The ability to divert fentanyl undetected from vials, replacing it with saline later administered to patients; and
• Heightened vulnerability of automated dispensing machines.

These common deficiencies in employee diversion cases emphasize the importance of each regulatory requirement in every registrant’s ability to account for the controlled substances they import, manufacture, distribute, dispense, and export.

One year after hosting a public workshop (“Advancing the Development of Interchangeable Products: Identifying Future Needs”), and as part of its BSUFA III commitments, FDA, on September 18, 2026, published for comment a strategy document entitled “BsUFA III Future Needs in the Development of Interchangeable Products Post-Workshop Strategy Document” (Strategy Document).

The Strategy Document summarizes the public workshop discussion and describes FDA’s future directions to support interchangeable biosimilar products while identifying future goals and priorities for the FDA’s biosimilar programs.  It further outlines the “significant obstacles” that manufacturers and stakeholders have faced in interchangeable data development, market access, and substitution.  It details the confusion among stakeholders, as well as hurdles in communication between FDA and such stakeholders, which ultimately led to a call for more comprehensive and practical guidance addressing specific development scenarios.   Additionally, workshop participants identified device-related human factors as a significant hurdle, including evaluation requirements such as Use-Related Risk Analysis and side-by-side comparison of physical characteristics, tasks, and labeling.  Specifically, industry asked for clarity on comparative analysis expectations, delivery device considerations, and other product-specific development scenarios.

The most significant takeaway from the Strategy Document is its articulation of an evolving scientific approach to what evidence is needed to demonstrate interchangeability.  But this presents little that’s new, as FDA has been slowly implementing these types of changes for a while now.   Nevertheless, it is both a regulatory milestone—a required BsUFA III deliverable—and it is a strategic signal of where the FDA intends to take interchangeable biosimilar policy—toward science-led, analytically grounded, and less burdensome development pathways that aim to expand patient access.

Comments on the Strategy Document are due November 17, 2026.

On top of the Strategy Document, FDA announced a BSUFA IV meeting being held on October 26, 2026 to discuss proposed recommendations and provide stakeholders an opportunity to share input on the recommendations.  The proposed BSUFA IV Commitment Letter is available here.

More than two decades after FDA last publicly grappled with the development of testosterone for women, the Agency is asking industry to take another look.

On September 17, 2026, FDA’s Office of Women’s Health (OWH) and the Center for Drug Evaluation and Research (CDER) convened a public workshop on testosterone use in menopausal women. The day-long meeting brought together clinicians, researchers, patients, and FDA officials to discuss what is known, what remains unknown, and, importantly for drug developers, what it may take to develop an FDA-approved testosterone product for women.

But perhaps the most remarkable part of the meeting was why it happened at all: women asked for it.

The roots of the workshop can be traced, at least in part, to FDA’s December 2025 public meeting on testosterone replacement therapy in men. More than 80% of comments submitted to the public docket following that meeting came from women, many calling attention to the lack of an FDA-approved testosterone product for women. At last week’s workshop, FDA repeatedly acknowledged the role those voices played in bringing the issue to the forefront.

This is notable in an area that has seen relatively little public regulatory attention for more than 20 years. In 2004, FDA’s Reproductive Health Drugs Advisory Committee considered Procter & Gamble’s Intrinsa, a transdermal testosterone patch developed for hypoactive sexual desire disorder (HSDD) in surgically menopausal women receiving estrogen. Today, in 2026, an FDA-approved testosterone product specifically indicated for women still does not exist.

But the absence of an approved product has not meant the absence of use. Women have been using testosterone products approved for men off-label as well as compounded testosterone formulations for years. The regulatory gap therefore has real world consequences: women are already using testosterone, but without a product developed, studied, approved and labeled specifically for them.

That reality gave the workshop a palatable sense of urgency. FDA was not discussing how to introduce an entirely new therapy into clinical practice. It was asking what evidence should be needed to support an FDA-approved product in an area where use has moved ahead of the regulatory framework.

Why Development Is So Difficult

The meeting also made clear why that regulatory gap has persisted. Testosterone presents several difficult and interconnected development questions, many of which remain unresolved.

The first is deceptively simple: what is the indication? FDA discussed potential areas of investigation including sexual dysfunction, musculoskeletal health, cognition, and mood. But the broad bucket of “testosterone for menopause” is not an indication. Each condition presents different questions about the appropriate population, evidence of clinical benefit, endpoints, dose, and benefit-risk assessment. FDA was clear that the drug and indication go together and that each potential use would need to stand on its own evidence.

Then comes the challenge of demonstrating efficacy. Sexual function trials can have substantial placebo responses, making it difficult to distinguish a treatment effect even when patients improve during a study. That problem is not merely theoretical. During the workshop, panelists discussed the experience with BioSante’s testosterone gel development program, which ultimately failed on efficacy amid a high placebo response and challenges with the sexual function efficacy measure used in the trials.

Even measuring testosterone presents challenges. FDA noted that the “normal” testosterone range in women is poorly defined and discussed variability in assays and measurement of free versus total testosterone. During the regulatory panel, FDA recommended measuring both free and total testosterone, at least initially, and discussed the importance of using sufficiently sensitive and accurate methods, including liquid chromatography-mass spectrometry (LC-MS/MS). While it might seem that at least this challenge would have been conquered in studies of testosterone use in men, an assay that performs adequately at testosterone concentrations typically observed in men may not provide the same performance at the lower concentrations encountered in women. FDA encouraged sponsors to discuss assay strategy with the Agency early to avoid measurement problems later in development.

Given the lack of a well-defined “normal” range of testosterone in women, it is not clear what or even if a particular serum testosterone concentration should serve as the therapeutic target. Individual response may vary, the relationship between circulating testosterone and clinical benefit remains uncertain, and FDA raised the basic question of “how high is too high.” The Agency therefore focused considerable attention on dose finding and exposure-response. Phase 2 may be particularly important for characterizing pharmacokinetics, pharmacodynamics, safety, and clinical response and selecting a dose with a reasonable likelihood of succeeding in Phase 3. The lowest effective dose may also differ depending on the indication.

Combination therapy adds another wrinkle. Women may use testosterone alongside estrogen, with or without a progestogen. FDA discussed the implications of developing testosterone as monotherapy versus as part of a combination regimen. A sponsor developing a fixed combination would need to study the combination and demonstrate the contribution of its individual components to efficacy and safety. Those choices can shape the clinical development program from the outset.

Long-term safety remains perhaps the most consequential evidentiary gap. Existing studies vary in formulation, dose, duration, population, and achieved testosterone exposure. Many randomized trials have been relatively short, while women with higher baseline cardiovascular risk have often been excluded. Questions also remain about breast and endometrial safety. FDA posited that these limitations make it difficult to characterize risks associated with chronic use in the population likely to receive an approved product.

Taken together, the development challenge is formidable. Sponsors must define a clinically meaningful indication and population, select endpoints capable of detecting benefit against what may be a substantial placebo response, establish reliable methods for measuring testosterone concentrations, characterize exposure-response, justify the dose, determine an appropriate treatment regimen, and generate a safety database adequate to support the proposed use.

FDA Is Inviting Conversation

Despite those challenges, the tone of the meeting was strikingly forward-looking, with several take-home messages for sponsors.

Patient input belongs at the beginning of development. FDA emphasized that patient input can help identify the outcomes that matter, inform trial design and recruitment, support fit-for-purpose clinical outcome assessments, and ultimately inform the benefit-risk assessment. That point carries particular weight here. Patient voices helped bring FDA to the table in the first place. Continued patient engagement may also be essential to designing studies capable of delivering the evidence FDA needs.

Dose-ranging and exposure-response work also deserve substantial attention before pivotal trials. Although these are familiar components of drug development, testosterone presents added challenges: there is no well-established therapeutic testosterone concentration for women, the relationship between serum concentrations and clinical benefit remains uncertain, and the lowest effective dose may differ by indication. Sponsors will need to think just as carefully about trial design and endpoint performance, particularly in settings susceptible to substantial placebo response. Assay strategy matters, particularly given the challenges of reliably measuring the lower testosterone concentrations generally observed in women. And defining requirements and planning for long-term safety cannot be an afterthought.

Perhaps most importantly, FDA repeatedly invited sponsors to engage with the Agency. FDA officials encouraged developers to discuss protocols, endpoints, assays, dose selection, and approaches to addressing long-term safety throughout development. The Agency reiterated the same message on multiple occasions: come to them early and often.

A Call to Action

The workshop ended where it began: with the need for more evidence.

FDA officials described the meeting as a “call to action” and expressed hope that it would catalyze sponsors to undertake the research needed to move the field forward.

But the call to action should not be directed at industry alone. The scientific and regulatory challenges discussed throughout the day will require continued engagement from FDA as well. The Agency has an important role to play in helping translate the questions identified at the workshop into workable development paths, including providing clarity around acceptable endpoints, dose-finding strategies, safety expectations, and approaches to filling longstanding evidence gaps.

We are excited to see what FDA, industry, and the women who started this conversation do next.

On September 10, 2026, the U.S. Attorney’s Office for the District of Massachusetts announced that Dompé U.S., Inc. agreed to pay $32 million to resolve allegations that it used patient assistance foundations to cover Medicare co-pays for patients receiving Oxervate, a biologic used to treat neurotrophic keratitis, a rare degenerative disease of the cornea. The settlement is the latest in a long line of government actions examining manufacturer support for patient assistance programs that subsidize Medicare beneficiaries’ out-of-pocket costs through independent charitable foundations. The publicly available settlement agreement contains a considerable amount of detail and provides useful insight into both the conduct at issue and the steps that earned the company cooperation credit.

Companies that have followed enforcement in this area will recognize many of the themes in DOJ’s allegations. More noteworthy is DOJ’s decision to highlight the company’s disclosure, cooperation, and remediation efforts so prominently in announcing the settlement. Before turning to those aspects of the resolution, however, it is worth examining the conduct that prompted the investigation.

The Conduct at Issue

According to the settlement agreement, prior to Oxervate’s U.S. launch, employees expressed reservations about bringing the product to market before patient-assistance funding was available. Following discussions with Dompé personnel, the National Organization for Rare Diseases (NORD) established a neurotrophic keratitis fund in late 2018, and the PAN Foundation later opened a similar fund in 2019, each receiving contributions from Dompé.

The agreement also describes a compliance consultant cautioning company personnel against using information concerning foundation activity to inform contribution decisions and warning that Dompé should not “reverse engineer” patient-assistance foundation data when determining funding levels. DOJ similarly focused on the company’s collection of information from foundations and from a specialty pharmacy that provided patient-support and reimbursement services for Oxervate patients, including information reviewed by personnel involved in contribution decisions.

The government’s concern was not simply that Dompé contributed to charitable foundations. Rather, the allegations focused on whether the company’s visibility into foundation funding needs and patient-assistance activity allowed it to make contribution decisions that benefited users of its own product. In DOJ’s view, those types of insights may call into question whether a foundation is operating independently from a manufacturer or instead functioning, at least in part, as a mechanism for subsidizing demand for a particular drug.

The Legal Backdrop

Medicare beneficiaries generally are required to bear a portion of the cost of covered drugs through co-payments, coinsurance, or deductibles. The government’s position has long been that manufacturers may not eliminate those costs for their own products, directly or indirectly, because doing so can influence purchasing decisions and increase utilization. In the government’s view, routing financial assistance through a nominally independent charitable foundation does not resolve that concern if the manufacturer effectively steers or influences the assistance being provided.

At its core, the case centers on a recurring DOJ concern: whether a manufacturer’s interactions with a charitable foundation effectively allow it to influence the availability of financial assistance for its own products. The government alleged that Dompé’s funding practices and access to foundation-related information crossed that line.

Those concerns have animated DOJ’s co-pay foundation enforcement efforts for years. In 2019, the Chronic Disease Fund, the Patient Access Network Foundation, and the Patient Services, Inc. each resolved allegations that they functioned as conduits for pharmaceutical manufacturers to subsidize Medicare beneficiaries’ use of the manufacturers’ own products. Those settlements helped establish the enforcement framework that continues to shape DOJ’s analysis of manufacturer interactions with patient assistance foundations today.

Self-Disclosure, Cooperation, and Remediation

The settlement agreement sheds additional light on why DOJ emphasized the company’s disclosure, cooperation, and remediation efforts in announcing the resolution.

According to the settlement agreement, Dompé farmaceutici S.p.A., the company’s Italian parent, voluntarily disclosed the conduct after issues were identified through an internal compliance review. The agreement notes that the company’s then-Chief Executive Officer personally contacted the U.S. Attorney’s Office for the District of Massachusetts to initiate the disclosure and that neither the U.S. Attorney’s Office nor other DOJ components were investigating the conduct at the time. The agreement further describes the matter as among the first disclosures made by a pharmaceutical company under DOJ’s False Claims Act self-disclosure guidelines that took effect in 2019.

By 2022, Dompé had revised its foundation-contribution practices, including removing its general manager from foundation decision-making, restricting access to foundation data, requiring objective and documented budgeting criteria, and limiting communications regarding foundation approval status between commercial and patient-access personnel. The settlement agreement also states that Dompé received cooperation credit under DOJ’s False Claims Act guidelines for its disclosure, internal investigation, production of overseas evidence, witness cooperation, remediation efforts, and acceptance of responsibility.

In announcing the settlement, the Department stated that it “encourages companies that uncover improper kickbacks to self-disclose such conduct,” using the resolution to reinforce its broader message regarding disclosure and cooperation.

Self-disclosure plainly did not insulate the company from a substantial resolution. Nevertheless, DOJ’s discussion of the company’s disclosure, cooperation, and remediation efforts suggests that the Department continues to view these cases as opportunities to reinforce broader compliance incentives. Notably, the announcement devoted substantial attention to how the issue was discovered and addressed, rather than focusing exclusively on the underlying allegations. And the “value” of the disclosure is notable in the multiplier applied to the restitution amount ($29 million), which was just a touch above singles and divergent from the typical doubles required for settled matters.

Takeaways

Foundation independence remains the core issue. The allegations centered on whether Dompé’s visibility into foundation funding levels and patient-assistance activity influenced its contribution decisions in a manner inconsistent with foundation independence. The settlement serves as a reminder that seemingly routine decisions regarding contribution levels, reserve funding, and information sharing may later be cited as evidence that a foundation was not operating as independently as its structure might suggest.

DOJ continues to emphasize cooperation and remediation. The settlement agreement describes a proactive disclosure made before DOJ initiated an investigation, a substantial internal review, cooperation that included overseas evidence and witnesses, and significant remedial measures. While self-disclosure does not eliminate liability, the resolution provides another example of how DOJ evaluates disclosure, cooperation, and remediation under its False Claims Act enforcement policies.

Expect continued scrutiny of manufacturer-supported patient assistance programs. The U.S. Attorney’s Office emphasized that it has recovered more than $1.4 billion through settlements and enforcement actions involving drug-company contributions to purported charities. That figure suggests that DOJ continues to view patient assistance programs involving co-pay foundations as an enforcement priority and that manufacturers should expect ongoing scrutiny of both the structure and operation of those arrangements.