SEC Brings Settled Action Against Mylan N.V. for Alleged Failure to Disclose Government Investigation

Companies that face non-public government investigations frequently confront challenging questions regarding whether and when to disclose the existence of the investigation, how much to disclose, and any duty to update the disclosure as the investigation proceeds.

On the one hand, regulatory investigations are generally confidential and it is axiomatic that the existence of an investigation does not reflect a conclusion of wrongdoing.  The premature disclosure of what may turn out to be a baseless investigation (perhaps instigated by a person with a grudge or self-interest) can needlessly cause internal disruption, complicate an internal investigation, unnecessarily alarm current shareholders, and – in the worst case – lead to a cascade of events that might cause a company to settle even a meritless case to achieve closure in the public domain.  On the other hand, the failure to disclose an investigation – particularly one that ultimately results in significant financial penalties and other sanctions – can harm purchasers of securities who make their investment decisions unaware of an investigation that could result in a stock drop or other negative consequences when the matter becomes public.  The same considerations and potentially high stakes can also arise in the context of a significant internal investigation initiated at a company’s own behest.

In a recently settled action against Mylan N.V. (“Mylan”), the Securities and Exchange Commission (the “SEC”) provides some perspective regarding the SEC’s views on how public companies should balance those considerations.[1]  The SEC alleged that Mylan committed accounting and disclosure violations for failing to timely disclose an otherwise confidential Department of Justice (the “DOJ”) investigation into whether Mylan overcharged Medicaid for its largest revenue and profit generating product, the EpiPen.  The investigation resulted in Mylan agreeing to pay $465 million to settle the investigation.  

The SEC alleged that a number of factors – including the DOJ’s decision not to close a serious investigation, the existence of a tolling agreement, and Mylan’s presentation to the DOJ on the question of damages – should have put Mylan on notice that it was required to disclose the existence of the DOJ’s investigation and to take a provision for losses under GAAP in connection with DOJ’s investigation.  Nestled in the SEC’s recitation of the facts was an event that seemingly was of limited legal significance but may have been of practical import: during the relevant period, Mylan significantly raised the price of EpiPen – a decision that provoked public and political attention and that led to congressional hearings.  Nonetheless, the settlement papers are important reading for all public companies considering disclosure of government investigations. 

Background of the Allegations

Mylan is a global pharmaceutical company that manufactures and sells EpiPen, a medication used to treat serious allergic reactions.  Prior to the settlement, Mylan was under public and political scrutiny for increasing the price of EpiPen from approximately $100 per two-pack in 2007 to over $600 per two-pack by 2016. 

From 2014 through 2016, EpiPen was Mylan’s most important and largest drug by sales and profit, generating annual sales of approximately $1 billion.  During that time, approximately 20% of Mylan’s EpiPen sales were made to Medicaid patients.  Like other pharmaceutical companies, Mylan participated in the Medicaid Drug Rebate Program (“MDRP”), which requires manufacturers to classify their drugs as “generic” or “branded,” in order for EpiPen to be covered by Medicaid.   

Mylan acquired the rights to EpiPen in 2007.  Relying on a 1997 letter that Merck KGaA, the predecessor owner of EpiPen, had received from a then-employee at the Centers for Medicare and Medicaid Services (“CMS”), Merck KGaA classified EpiPen as a generic drug under the MDRP (the “1997 letter”).  Mylan continued that classification.  As a result, it was required to pay lower quarterly rebates to the government than it would have had to pay had EpiPen been classified as a branded drug.   

From late 2013 through 2014, after Mylan acquired the rights to EpiPen, CMS began to question Mylan’s classification of EpiPen.  It notified Mylan on October 29, 2014 of its view that EpiPen should be classified as a branded drug and that Mylan should not rely on the 1997 letter as guidance.  According to the SEC’s settled complaint, other facts also supported the classification of EpiPen as a branded drug, including that it was approved by the FDA pursuant to a new drug application and internal correspondence between a Mylan employee and executive stating that if a competitor had requested a similar generic classification, “they would have been denied given today’s market size and that ours was a loose interpretation to begin with.”[2]  Accordingly, on an October 29, 2014 call, CMS asked Mylan to update the EpiPen classification to “brand.”  Mylan declined to do so.

Just one week after the CMS’ determination, the DOJ began a civil investigation into Mylan’s prior EpiPen classification for potential violations of the False Claims Act, which in certain cases provides for treble damages.  The DOJ rejected Mylan’s requests to close the investigation and requested a tolling agreement, which the company signed.  The DOJ issued subpoenas and document and information requests from November 2014 through 2016, culminating with settlement negotiations between July and October 2016.  Mylan disclosed the DOJ’s investigation for the first time on October 7, 2016 when the parties reached a settlement in principle for $465 million.

The SEC Action

On September 27, 2019, the SEC alleged in a settled federal complaint that Mylan had violated Securities Act Sections 17(a)(2) and 17(a)(3) (negligence-based misstatements and course of conduct) and Exchange Act Section 13(a) and Exchange Act Rules 12b-20, 13a-1, 13a-11, and 13a-13 (reporting violations).  The SEC’s complaint was predicated on essentially two claims. 

First, the SEC alleged that Mylan’s risk disclosures relating to the classification of EpiPen on its 2014 and 2015 annual reports on Form 10-K were misleading.  This was because – under Regulation S-K Item 303 – public companies must “[d]escribe any known trends or uncertainties that have had or that the registrant reasonably expects will have a material favorable or unfavorable impact on net sales or revenues or income from continuing operations.”[3]  The SEC alleged that Mylan made misleading statements with respect to the risk factors in its 2014 and 2015 annual reports when it disclosed the risk that CMS “may” take the position that its submissions to Medicaid were incorrect, because a CMS official had, at that point, told Mylan that it disagreed with Mylan’s classification of EpiPen as a generic drug – a position that Mylan did not adopt.  Because Mylan did not disclose CMS’ actual disagreement with Mylan’s classification of EpiPen, the SEC alleged that it had misleadingly presented a potential risk to investors. 

Second, the SEC alleged both that Mylan should have disclosed a material loss contingency related to the DOJ’s investigation into its classification of EpiPen, and that it should later have accrued for that loss on the basis of the likelihood that the DOJ action resulting in a loss to Mylan was probable and reasonably estimable.[4]  SEC Regulation S-X requires an issuer’s financial statements to comply with GAAP.  Mylan therefore should have disclosed the DOJ investigation when the material loss contingency became “reasonably possible” (i.e., when the chance of the future event or events occurring became more than remote but less than likely).  Additionally, Mylan allegedly should have also recorded an accrual for a material loss contingency as a charge against income in its financial statements when the loss became probable (i.e., when the future event or events became likely to occur) and reasonably estimable.[5] 

The SEC highlighted several key points in the investigation that, in its view, should have served as triggering events for disclosure under Regulation S-X prior to Mylan’s October 7, 2016 statement.  First, the SEC alleged that Mylan knew or should have known that a material loss contingency arising out of the DOJ investigation was “reasonably possible” in the third quarter of 2015, because following an August 2015 presentation by Mylan, the DOJ was unpersuaded to close the investigation and Mylan signed a tolling agreement.  Although Mylan disclosed the settlement with the DOJ as soon as the settlement amount was agreed upon, the SEC indicated that the issuer should have at least disclosed the existence of the investigation at an earlier point – in its Form 10-Q for the third quarter of 2015 – in light of the potential for material losses arising out of Mylan’s biggest product and potentially because it seemed that the DOJ was not interested in dropping the case.  The SEC also highlighted that Mylan’s failure to timely disclose the DOJ investigation was inconsistent with its practice of disclosing other similar investigations, including open investigations with the DOJ related to pricing, to further support its finding that Mylan had failed to timely disclose the investigation. 

The next disclosure-triggering event occurred in the second quarter of 2016 after Mylan had provided the DOJ with its estimate for potential non-trebled damages ranging from $114 to $260 million should it be found liable for misclassifying EpiPen.  The SEC alleged that Mylan knew or should have known that the material losses became probable and reasonably estimable at this point and therefore should have accrued its best estimate of the loss at that time. 

Key Takeaways

The question of when and whether to disclose a confidential investigation that has not yet resulted in a final determination that charges should be brought is challenging (to say nothing of when to reserve for potential losses possibly arising out of any investigation).  The answer to that question depends, of course, on facts and circumstances.  Though the Mylan settlement does not provide any bright lines, it does provide some illustrative takeaways for companies as described below. 

It is not the law that companies are automatically required to disclose an investigation upon learning of it.  Federal and state regulators may initiate investigations upon suspicion of wrongdoing; however, the fact that a regulator or government authority is asking questions does not necessarily require a public company to disclose either that it is being asked questions or the subject matter of those questions.  Nor is there a free-standing independent obligation to disclose uncharged, unadjudicated wrongdoing even upon the receipt of a Wells Notice. See Richman v. Goldman Sachs Grp., Inc., 868 F. Supp. 2d 261, 274 (S.D.N.Y. 2012) (“There is nothing in Regulation S–K, Item 103 which mandates disclosure of Wells Notices.  Item 103 does not explicitly require disclosure of a Wells Notices, and no court has ever held that this regulation creates an implicit duty to disclose receipt of a Wells Notice.”).[6]

We also do not read the SEC action as requiring a public company to disclose an investigation the moment a regulator asks for a tolling agreement or makes a decision not to close an investigation, particularly when the request is made prior to the regulator having received all of the documents and information it believes necessary to make a liability determination.  The DOJ and SEC routinely ask companies to sign tolling agreements, particularly when they are still in the fact-finding stage of an investigation.  The fact that a company has agreed to such a request – whether to maintain good relations with the regulator, to give itself time to conduct its own investigation, or to convince a regulator that no charges are appropriate – does not itself trigger a disclosure obligation.  Nor, given that an initial request for documents or information does not itself necessarily trigger a disclosure obligation, does a regulator’s decision to continue an investigation, so that it receives the requested information, necessarily trigger a disclosure obligation. 

The fact that a company includes a hypothetical damages estimate in a submission to a regulator does not necessarily require the company to take a provision for those potential damages.  Regulators sometimes ask for damages estimates assuming that there is liability.  The fact that a company answers that question while maintaining a position of non-liability does not make its estimate reasonable and probable requiring an accounting adjustment.  It is difficult to tell from the face of the Mylan settlement the nature of its submission to the DOJ, what was in that submission, or the surrounding facts that gave rise to the need to take a provision.  

Still, there are some important lessons to be learned from the Mylan settlement.  First, the decision whether or not to disclose a regulatory investigation is fraught with risk – whether the company discloses or not, careful consideration must be given to that decision with the assistance of counsel and, often, the company’s auditors.  The same is true for an internal investigation that may have material implications on a company’s business.  Second, particular care must be taken when – as was the case with EpiPen – the investigation concerns a portion of the company’s business that is important and where an adverse conclusion by a regulator could have significant and potentially material financial consequences.  Here, the SEC went out of its way to note that EpiPen was Mylan’s largest revenue and profit generating product during the relevant period.  Third, that practical risk is even greater when the company is in the public eye: as noted, Mylan’s decision to raise the price of EpiPen by 500% caused public outcry, a fact that undoubtedly put pressure on the SEC to investigate as a matter of its own prosecutorial discretion.  Fourth, a company must evaluate throughout the course of the investigation and discussions with regulators whether disclosure should be made or updated.  Here, the SEC concluded that disclosure was not required when the DOJ first sent a request for information but became required later as a result of communications with the government. 

Finally, two practice points.  It’s hard to believe that Mylan did not consult with its auditors regarding whether disclosure was required or not: the fact that it did so plainly did not insulate it from charges but may explain why the SEC charged Mylan only with Securities Act violations sounding in negligence.  In addition, and notably, the SEC relied on communications between a Mylan employee and a Mylan consultant during the review of the disparate classifications as well as communications among Mylan employees regarding that classification.  The SEC’s reliance on such communications highlights the need for companies, in the course of investigations, to exercise care with respect to the content of internal communications, particularly those that are not necessary for business purposes and, where appropriate, to consult and involve counsel in the decisions on how to respond to regulatory inquiries.  It is easy for the regulatory and criminal authorities to take out of context certain internal communications generated in response to regulatory requests or internal reviews. It is therefore critical that companies are circumspect in the manner in which they respond to and manage any resulting investigations – particularly in the early stages where initial internal discussions may be uninformed or worse.[7]

The article was also republished by the Columbia Law School Blue Sky Blog and Law360.