HSGAC gran Fueling an Epidemic Insys Therapeufics and The Sysfemic Manipulafion of Prior Aufhorizafion U.S. Senafe Homeland Securify Governmenfal Affairs Commiffee, Ranking Member's Office Fueling an Epidemic Insys Therapeutics and the Systemic Manipulation of Prior Authorization The opioid epidemic has exacted a staggering human and financial cost in the United States over the past 20 years. Approximately 183,000 Americans died from prescription opioid overdoses between 1999 and 2015, with more than 15,000 Americans dying in 2015 alone.1 According to the Centers for Disease Control and Prevention (CDC), in 2015 “[t]he age-adjusted rate of drug overdose deaths in the United States in 2015…was more than 2.5 times the rate in 1999.”2 Provisional 2016 statistics from the CDC also show that “[d]rug deaths involving fentanyl more than doubled from 2015 to 2016,” and “deaths involving synthetic opioids, mostly fentanyls, have risen to more than 20,000 from 3,000 in just three years.”3 In Missouri, the rate of prescription opioid-related inpatient hospitalizations and emergency room visits more than doubled from 187 per 100,000 to 424 per 100,000 between 2005 and 2014.4 Similarly, Medicare Part D spending on commonly abused opioids increased 165% between 2006 and 2015, and one out of three Part D recipients received at least one prescription opioid in 2016 at a cost of $4.1 billion.5 In response to this crisis, Sen. McCaskill issued wide-ranging requests for documents related to opioid sales and marketing efforts to five major opioid manufacturers.6 These requests focused on internal estimates concerning the risk of opioid addiction, compliance audits and reports concerning sales and marketing policies, marketing and business plans, materials related to manufacturer payments to physicians and manufacturer-created physician presentations, funding of educational materials targeted to opioid-prescribing physicians, and funding for major pain advocacy groups and other groups. In response, the minority staff has received thousands of pages of internal company documents, including extensive materials from Insys Therapeutics. Drawing on these documents and other materials, this report provides new information regarding the significant efforts Insys has undertaken to reduce barriers to the prescription of Subsys, its powerful fentanyl product. These efforts include actions to mislead pharmacy benefit managers (PBMs) about the role of Insys in the prior authorization process and the presence of breakthrough cancer pain in potential Subsys patients. An internal Insys document suggests Insys apparently lacked even basic measures to prevent its employees from manipulating the prior authorization process and received clear notice of these deficiencies. In the case of Subsys patient Sarah Fuller, an audio recording reveals that an Insys employee repeatedly misled representatives of Envision Pharmaceutical Services Centers for Disease Control and Prevention, Prescription Opioid Overdose Data (Aug. 1, 2017) (www.cdc.gov/drugoverdose/data/overdose.html). Centers for Disease Control and Prevention, Drug Overdose Deaths in the United States, 1999–2015 (Feb. 24, 2017) (www.cdc.gov/nchs/products/databriefs/db273.htm). 3 The First Count of Fentanyl Deaths in 2016: Up 540% in Three Years, New York Times (Sept. 2, 2017) (www.nytimes.com/interactive/2017/09/02/upshot/fentanyldrug-overdose-deaths.html). 4 Hospital Industry Data Institute, Alarming Trends in Hospital Utilization for Opioid Overuse in Missouri (Oct. 2015) (www.mhanet.com/mhaimages/HIDIHealthStats/ Opioids_HealthStats_1015.pdf). 5 Department of Health and Human Services Office of Inspector General, High Part D Spending on Opioids and Substantial Growth in Compounded Drugs Raise Concerns (OEI-02-16-00290) (June 21, 2016); Department of Health and Human Services Office of Inspector General, Opioids in Medicare Part D: Concerns about Extreme Use and Questionable Prescribing (OEI-02-17-00250) (July 13, 2017). 6 Letter from Sen. Claire McCaskill to Santosh Vetticaden, Interim Chief Executive Officer of Insys Therapeutics, Inc. (March 28, 2017). 1 2 PAGE 2 to obtain approval for her prescription. The result, in the case of Ms. Fuller, was death due to allegedly improper and excessive Subsys use. BACKGROUND ON INSYS THERAPEUTICS AND SUBSYS Insys Therapeutics was co-founded in 2002 by Dr. John Kapoor, a serial pharmaceutical industry entrepreneur “known for applying aggressive marketing tactics and sharp price increases on older drugs.”7 In 2012, Insys received U.S. Food and Drug Administration (FDA) approval for Subsys, a fentanyl sublingual spray product designed to treat breakthrough cancer pain, and the drug proved incredibly successful financially.8 Insys had “the best-performing initial public offering in 2013,” and, over the next two years, revenues tripled and profits rose 45%.9 The value of company stock increased 296% between 2013 and 2016.10 To prevent the overprescription and abuse of powerful and expensive drugs like Subsys, insurers— often using PBMs—employ a process known as prior authorization. As noted in a Permanent Subcommittee on Investigations report Sen. McCaskill and Sen. Rob Portman issued on October 4, 2016, the prior authorization process “requires additional approval from an insurer or its pharmacy benefit manager before dispensing. … Prior authorization policies can also impose ‘step therapy,’ which requires beneficiaries to first use less expensive medications before moving on to a more expensive approach.”11 With regard to Insys specifically, recent court filings explain that insurers have “required that a prior authorization be obtained before a claim [can] be submitted for a Subsys® prescription.”12 This process includes “confirmation that the patient had an active cancer diagnosis, was being treated by an opioid (and, thus, was opioid tolerant), and was being prescribed Subsys® to treat breakthrough pain that the other opioid could not eliminate. If any one of those factors was not present, the prior authorization would be denied … meaning no reimbursement would be due.”13 These screening processes reportedly raised significant obstacles to Subsys prescriptions shortly after Insys introduced the drug. According to a criminal indictment filed against former Insys CEO Michael Babich and five other Insys executives, an internal company analysis in November 2012 revealed that insurers and PBMs approved reimbursements for Subsys in only approximately 30% of cases.14 Fentanyl Billionaire Comes Under Fire as Death Toll Mounts From Prescription Opioids, Wall Street Journal (Nov. 22, 2016) (www.wsj.com/articles/fentanylbillionaire-comes-under-fire-as-death-toll-mounts-from-prescription-opioids-1479830968). 8 Id. 9 Id. 10 An Opioid Spray Showered Billionaire John Kapoor in Riches. Now He’s Feeling the Pain, Forbes (Oct. 4, 2016) (www.forbes.com/sites/matthewherper/2016/10/04/death-kickbacks-and-a-billionaire-the-story-of-a-dangerous-opioid/). 11 Senate Permanent Subcommittee on Investigations, Combatting the Opioid Epidemic: A Review of Anti-Abuse Efforts in Medicare and Private Health Insurance Systems (Oct. 4, 2016); see also Department of Health and Human Services, Centers for Medicare & Medicaid Services, How Medicare Prescription Drug Plans & Medicare Advantage Plans with Prescription Drug Coverage (MA-PDs) Use Pharmacies, Formularies, & Common Coverage Rules (Oct. 2015). 12 Complaint (July 12, 2017), Blue Cross of California, Inc., et al. v. Insys Therapeutics, Inc., D. Ariz. (No. 2:17 CV 02286). 13 Id. 14 Indictment (Dec. 6, 2016), United States v. Babich, et al., D. Mass. (No. 1:16 CR 10343). 7 PAGE 3 In response to these challenges, Insys allegedly created a prior authorization unit, known at one point as the Insys Reimbursement Center (IRC), to intervene with PBMs and secure reimbursements between January 2013 and October 2016.15 Led by an Insys employee named Elizabeth Gurrieri, IRC employees reportedly received significant financial incentives and management pressure—including quotas and group and individual bonuses—to boost the rate of Subsys authorizations.16 According to Patty Nixon, a former Insys employee, Ms. Gurrieri personally pressured IRC employees to improve the rate of prescription approvals, noting that “Dr. Kapoor’s not happy, we have to get these approvals up.”17 IRC employees allegedly met this demand through a number of techniques. Employees, for example, reportedly falsified medical histories for prospective Subsys patients, “fraudulently assert[ing] that a patient had a cancer diagnosis regardless of the patient’s history and regardless of whether the prescriber had prescribed Subsys® for a different diagnosis.”18 In response to increased scrutiny from PBMs and the U.S. Department of Health and Human Services, Insys allegedly developed a canned response to questions concerning whether a potential Subsys patient suffered from breakthrough cancer pain. In this response, Insys employees stated that “[t]he physician is aware that the medication is intended for the management of breakthrough pain in cancer patients [and] [t]he physician is treating the patient for their pain (or breakthrough pain, whichever is applicable).”19 According to an affidavit filed in support of criminal charges against Ms. Gurrieri, the script “deliberately omitted the word ‘cancer’ in order to mislead agents of insurers and PBMs.”20 The IRC also allegedly misled PBMs and insurers about the unit’s role in facilitating approvals for Subsys.21 To prevent PBMs from tracing calls back to Insys, for example, the IRC obscured its outgoing phone number on caller ID.22 When PBMs required a phone number for a return call, Insys employees reportedly provided a 1-800 number manned by another Insys representative—instead of contact information for the prescribing physician.23 Insys executives also allegedly told IRC employees to claim they were calling “from” a physician’s office; later, “employees were instructed to tell agents of insurers and pharmacy benefit managers that they were calling ‘on behalf’ of a specific doctor, and were ‘with’ a specific doctor’s office.”24 According to a class action lawsuit, Insys management “was aware that only about 10% of prescriptions approved through the Prior Authorization Department were for cancer patients,” and an Oregon Department of Justice investigation found that 78% of preauthorization forms submitted See Complaint (July 12, 2017), Blue Cross of California, Inc., et al. v. Insys Therapeutics, Inc., D. Ariz. (No. 2:17 CV 02286). Murder Incorporated: Insys Therapeutics, Part I, Southern Investigative Reporting Foundation (Dec. 3, 2015) (sirf-online.org/2015/12/03/murder-incorporatedthe-insys-therapeutics-story/); see also Indictment (Dec. 6, 2016), United States v. Babich, et al., D. Mass. (No. 1:16 CR 10343). 17 Fentanyl Billionaire Comes Under Fire as Death Toll Mounts From Prescription Opioids, Wall Street Journal (Nov. 22, 2016). 18 Complaint (July 12, 2017), Blue Cross of California, Inc., et al. v. Insys Therapeutics, Inc., D. Ariz. (No. 2:17 CV 02286). 19 Indictment (Dec. 6, 2016), United States v. Babich, et al., D. Mass. (No. 1:16 CR 10343). 20 Affidavit of Special Agent Paul S. Baumrind, Federal Bureau of Investigation, In Support of a Criminal Complaint and Arrest Warrant (Oct. 12, 2016), United States v. Gurrieri, D. Mass. (No. 1:17 CR 10083); see also Complaint (July 12, 2017), Blue Cross of California, Inc., et al. v. Insys Therapeutics, Inc., D. Ariz. (No. 2:17 CV 02286). 21 Indictment (Dec. 6, 2016), United States v. Babich, et al., D. Mass. (No. 1:16 CR 10343). 22 Murder Incorporated: Insys Therapeutics, Part I, Southern Investigative Reporting Foundation (Dec. 3, 2015); see also Indictment (Dec. 6, 2016), United States v. Babich, et al., D. Mass. (No. 1:16 CR 10343). 23 Murder Incorporated: Insys Therapeutics, Part I, Southern Investigative Reporting Foundation (Dec. 3, 2015). 24 Indictment (Dec. 6, 2016), United States v. Babich, et al., D. Mass. (No. 1:16 CR 10343). 15 16 PAGE 4 by Insys on behalf of Oregon patients were for off-label uses.25 In just one example, an Anthem review of Subsys claims “revealed that 54% of members with Subsys® prescriptions that had been reimbursed by Anthem did not actually have an underlying cancer diagnoses,” and “[f]or an additional 6% of members with reimbursed Subsys® prescriptions, it was unclear whether Subsys® was properly prescribed.”26 Anthem estimates that it “paid over $19 million in reimbursements for Subsys® prescriptions that were not covered by Anthem’s plans.”27 INSYS KNEW ABOUT PROBLEMATIC PRIOR AUTHORIZATION PRACTICES AND FAILED TO TAKE CORRECTIVE ACTION Internal Insys documents suggest the company knew—more than a year before the events involving Sarah Fuller, described below—that the IRC lacked formal policies or monitoring procedures to ensure proper communication between Insys employees and healthcare professionals. Insys, in other words, lacked even basic measures to prevent its employees from manipulating the prior authorization process and received clear notice of these deficiencies. In an internal presentation dated 2012 and entitled, “2013 SUBSYS Brand Plan,” Insys identified one of six “key strategic imperatives” as “Mitigate Prior Authorization barriers.”28 On a later slide, the company identified several tasks associated with this effort, including “Build internal [prior authorization] assistance infrastructure,” “Establish an internal 1-800 reimbursement assistance hotline,” and “Educate field force on [prior authorization] process and facilitation.”29 Additional materials produced by Insys to the minority staff suggest, however, that Insys did not match these efforts with sufficient compliance processes to prevent fraud and was internally aware of the danger of problematic practices. Specifically, on February 18, 2014, Compliance Implementation Services (CIS)—a healthcare consultant—issued a draft report to Insys titled, “Insys Call Note, Email, & IRC Verbatim Data Audit Report.”30 The introduction to the report explained that “CIS was approached by INSYS’ legal representative … on behalf of the Board of Directors for Insys to request that CIS support in review of certain communications with Health Care Professionals (HCPs) and INSYS employees, and report how there were being documented.”31 Insys had expressed concerns “with respect to communications with HCPs by INSYS employees being professional in nature and in alignment with INSYS approved topics regarding off or on-label promotion of an INSYS product, and general adherence to INSYS documentation requirements.”32 An additional concern The Pain Killer: A Drug Company Putting Profits Above Patients, CNBC (Nov. 4, 2015) (www.cnbc.com/2015/11/04/the-deadly-drug-appeal-of-insyspharmaceuticals.html). 26 Complaint (July 12, 2017), Blue Cross of California, Inc., et al. v. Insys Therapeutics, Inc., D. Ariz. (No. 2:17 CV 02286). 27 Id. 28 Insys Therapeutics, Inc., 2013 Subsys Brand Plan, 2012 Assessment (2012) (INSYS_HSGAC_00007472) (selected slides attached as Exhibit A). 29 Id. at INSYS_HSGAC_00007473. 30 Compliance Implementation Services, Insys Call Note, Email & IRC Verbatim Data Audit Report (Feb. 18, 2014) (INSYS_HSGAC_00007763) (attached as Exhibit B). 31 Id. at INSYS_HSGAC_00007765. 32 Id. 25 PAGE 5 “stemmed from the lack of monitoring of commercial activities where these types of interactions could occur.”33 Given these issues, Insys requested that CIS review—in part—“the general communications from the INSYS Reimbursement Center (IRC) to HCPs, their office staff or representatives, as well as health insurance carriers … to ensure they were appropriate in nature with respect to specific uses of SUBSYS, INSYS’ commercially marketed product.”34 According to the findings CIS issued, Insys lacked formal policies governing the actions of its prior authorization unit. For example, “[n]o formal and approved policy on appropriate communications between IRC employees and HCPs, their staff, [health care insurers (HCIs)], or patients exists…that governs the support function of obtaining a prior authorization for the use of SUBSYS.”35 In addition, the report noted that “there were also gaps in formally approved foundational policies, procedures, and [standard operating procedures] with respect to required processes specifically within the IRC.”36 In fact, “[t]he majority of managerial directives, changes to controlled documents or templates, as well as updates or revisions to processes were not formally approved, documented, and disseminated for use, and were sent informally via email blast.”37 Although four informal standard operating procedures existed with regarded to IRC functions, these documents “lacked a formal review and approval” and failed to “outline appropriately the actions performed within the IRC.”38 The report also explains that Insys lacked procedures for auditing interactions between IRC employees and outside entities. According to CIS, “no formal, documented, or detailed processes by which IRC representatives’ calls via telephone were audited for proper communication with HCPs or HCIs in any fashion [existed] other than random physical review of a call in a very informal and sporadic manner.”39 More broadly, the report notes that “no formal and documented auditing and monitoring or quality control policy, process, or function exists between IRC employee communications and HCPs, HCP staff, HCIs, or patients.”40 At the end of the report, CIS provided a number of recommendations concerning IRC activities. First, CIS suggested that IRC management “formally draft and obtain proper review and approval of an IRC specific policy detailing the appropriate communications that should occur while performing the IRC associate job functions and interacting with HCPs.” 41 Similarly, IRC management was urged to formally draft IRC-specific standard operating procedures “specific to each job function within the IRC,” accompanied by “adequate training and understanding of these processes.”42 To ensure compliance with IRC standards, Insys was also directed to create an electronic system to allow Id. Id. 35 Id. at INSYS_HSGAC_00007770. 36 Id. at INSYS_HSGAC_00007768. 37 Id. at INSYS_HSGAC_00007771. 38 Id. at INSYS_HSGAC_00007770. 39 Id. at INSYS_HSGAC_00007769. 40 Id. at INSYS_HSGAC_00007771. 41 Id. at INSYS_HSGAC_00007770. 42 Id. at INSYS_HSGAC_00007771. 33 34 PAGE 6 management “to monitor both live and anonymously IRC employee communications both incoming and outgoing.”43 Finally, CIS recommended that Insys institute a formal process for revising and updating “IRC documentation used for patient and HCP data.”44 The CIS report concluded by noting, in part, that a review of ten conversations between IRC employees and healthcare providers, office staff, and insurance carriers revealed “that all IRC staff was professional in communication, and in no instance was inaccurate or off-label usage of SUBSYS communicated.”45 Yet within a year of this conclusion, according to the recording transcribed below, an Insys IRC employee appears to have misled a PBM representative regarding the IRC employee’s affiliation and the diagnosis applicable to Sarah Fuller. The alleged result, in that case, was death due to inappropriate and excessive Subsys prescriptions. INSYS REPRESENTATIVE SOUGHT AUTHORIZATION FOR PATIENT SARAH FULLER As part of its investigation, the minority staff received an audio recording of conversations between an Insys employee and PBM representatives related to a Subsys prescription for Sarah Fuller, who later died from an alleged fentanyl overdose. This recording suggests the IRC employee in question repeatedly misled Envision Pharmaceutical Services to obtain approval for Subsys treatment for Ms. Fuller. The recording reveals that the Insys employee identified herself as being “with” the office of Ms. Fuller’s doctor; in the second conversation, the employee confirms she is “calling from the doctor’s office.” The Insys employee also states that Subsys is “intended for the management of breakthrough cancer pain” without explicitly claiming that Ms. Fuller suffers from this type of pain. She then states that Ms. Fuller suffers from breakthrough pain—pointedly dropping “cancer” from the description. Later, when asked whether the Subsys prescription will treat “breakthrough cancer pain or not,” the Insys employee sidesteps the question by merely stating there is “no code for breakthrough cancer pain.” She then reaffirms that the prescription is “for breakthrough pain, yeah.” Background about Sarah Fuller According to a March 23, 2017, complaint filed in the Superior Court of Middlesex County, New Jersey, Sarah A. Fuller died from a Subsys overdose on March 25, 2016.46 In 2014, Ms. Fuller allegedly sought treatment under the care of Dr. Vivienne Matalon of Cherry Hill to manage the medications she took for various health conditions, including fibromyalgia and back pain.47 During this initial consultation, Ms. Fuller’s parents indicated she had previously overcome an addiction to narcotic pain medication; despite this information, Dr. Matalon Id. Id. 45 Id. at INSYS_HSGAC_00007772. 46 Complaint (March 23, 2017), Fuller v. Matalon, et al., Middlesex Cty. Sup. Ct. (No. L1859-17). 47 Id. 43 44 PAGE 7 prescribed OxyContin and Percocet to Ms. Fuller over the next few months.48 In January 2015, Dr. Matalon, Ms. Fuller, and her father allegedly met with an Insys representative to discuss Subsys as a remedy for Ms. Fuller’s neck and back pain.49 According to the complaint, “[n]either the Insys sales representative nor Dr. Matalon informed Sarah or her father that Subsys was fentanyl and that it was only approved and indicated for patients that were experiencing breakthrough cancer pain from malignant cancer.”50 Over the next several months, Ms. Fuller received increasing amounts of Subsys on a monthly basis until she was admitted, on October 28, 2015, to a local hospital suffering from “hypersedation with hypoxia secondary to narcotics and sedatives.”51 Despite instructions to discontinue Subsys—included in medical records provided to Dr. Matalon—Ms. Fuller received additional Subsys prescriptions, along with prescriptions for Percocet, OxyContin, and Alprazolam, over the next five months.52 On March 25, 2016, Ms. Fuller died “due to an adverse reaction to prescription medications.”53 During the 14-month period in which Ms. Fuller received Subsys treatment, Medicare paid as much as $24,000 per month for the prescriptions.54 According to the Centers for Medicare & Medicaid Services (CMS) Open Payments database, Dr. Matalon received almost $600 in payments from Insys in 2015.55 Although this amount pales in comparison to other payments physicians have received from the company, a clear link exists between even minimal manufacturer payments and physician prescribing practices. A 2016 study published in JAMA Internal Medicine, for example, found “a significant association between [a physician] attending a single meal promoting a specific drug, with a mean value of less than $20, and the prescribing of the promoted drug over therapeutic alternatives.”56 In addition, “additional meals and costlier meals [were] associated with greater increases in prescribing of the promoted drug.”57 ProPublica has similarly found that “doctors who received industry payments were two to three times as likely to prescribe brandname drugs at exceptionally high rates as others in their specialty.”58 Insys Representative Misleads PBM to Obtain Prior Authorization The minority staff has obtained an audio recording of a conversation between an Insys employee and the PBM Envision, which provided prior authorization services in connection Id. Id. 50 Id. 51 Id. 52 Id. 53 Id. 54 Id. 55 Open Payments Data, Centers for Medicare & Medicaid Services, Physician Profile for Vivienne I. Matalon (openpaymentsdata.cms.gov/physician/153888/payment-information) (accessed July 18, 2017). 56 Colette DeJong, et al., Pharmaceutical Industry-Sponsored Meals and Physician Prescribing Patterns for Medicare Beneficiaries, JAMA Internal Medicine (June 20, 2016). 57 Id. 58 Now There’s Proof: Docs Who Get Company Cash Tend to Prescribe More Brand-Name Meds, ProPublica (March 17, 2016) (www.propublica.org/article/doctors-who-take-company-cash-tend-to-prescribe-more-brand-name-drugs). 48 49 PAGE 8 with the Subsys prescription for Ms. Fuller. During this January 2015 conversation, an IRC employee discussed prior authorization for Subsys with a representative from Convey Health Solutions, a call center support vendor for Envision Pharmaceutical Services, as well as a member of the clinical department of EnvisionRx Plus. In the first portion of this recording, the Insys employee begins her conversation with a PBM representative by misleadingly identifying herself as “with the doctor’s office.” At no point does the employee identify herself as working for Insys or explain she is calling from an Insys office. After being transferred to the Envision clinical department for further questioning, the Insys employee confirms she is calling “from” a doctor’s office and claims the prior authorization request is “urgent.” Insys Representative: Hi, my name is [XXXX], and I’m with the doctor’s office. I never heard an option for me to choose to … I need to see if a certain medication requires authorization. Representative from Convey Health Solutions: Ok, can I … for security purposes can I have your NPI number? I: It’s [XXXX]. R: You say [XXXXX]? I: Yes. R: Okay and which doctor is that? I: It’s Dr. Matalon. R: Okay and for security purposes can you verify the member ID number? I: Yes, it’s … well, you know what, I have … I only have their Medicare ID number. R: Okay, you can go ahead with that number. I: It’s [XXXX]. […] * * * R: Hi [XXXX], thank you so much for holding. Yeah, I’m going to have to connect you to our clinical department so that they can go ahead and try to do that override for you. […] * * * Envision Clinical Department Representative: Clinical Department, this is [XXXX]. How can I help you? PAGE 9 I: Hi [XXXX], you guys must be very busy people. E: We are, and I apologize for the long wait, but how can I help you now? I: I need to know if a certain medication requires authorization, and if it does, can I do it over the phone. It’s urgent. E: Oh okay. You’re calling from the doctor’s office then, correct? I: Yeah, Dr. Matalon’s office. […] As the conversation with the Envision clinical department representative proceeds, the Insys employee correctly notes that Subsys is “intended for the management of breakthrough cancer pain,” but then states only that Dr. Matalon is treating Ms. Fuller for “breakthrough pain.” When questioned as to whether Ms. Fuller does, in fact, suffer from breakthrough cancer pain, the Insys employee avoids responding directly and instead explains “there’s no code for breakthrough cancer pain.” She then states again that the Subsys prescription is “for breakthrough pain, yeah,” and the Envision representative discontinues this line of questioning. Toward the end of the call, the Insys employee states that Ms. Fuller is anticipated to remain on Subsys indefinitely. E: Okay and what is the diagnosis for the patient? I: Let me look through here [inaudible] … medication is intended for the management of breakthrough cancer pain. The doctor is treating the patient for breakthrough pain, with a diagnosis code of 338.29— […] E: Thank you. Is it also for the breakthrough cancer pain or not? I: Well, there’s no code for breakthrough cancer pain. E: Yeah, and that’s fine. I typed out the description; I just want to make sure that I heard you correctly. I: It’s for breakthrough pain, yeah. E: Good. Okay. […] E: And what is the anticipated duration of therapy? I: Well, there’s no end date. I mean, we just try to give her a year and go from there. E: Okay. And is this a brand or a generic? This is single-source, no generic, so the brand is required…. What other medications in the same therapeutic class have been tried? I: Okay, they’ve tried morphine, morphine sulfate…. Let me know if you need me to spell something or go slow, okay? E: You’re doing fine at the pace you’re at right now. Morphine sulfate, okay. P A G E 10 I: Oxycodone, OxyContin, and I think that’s all I can tell from the notes. E: Okay, were those ineffective? I: Yeah, let me see what the note says. It says it had an inadequate analgesic effect. Patient is opioid tolerant. E: Thank you. And are there any alternatives that are contraindicated, that are not appropriate for the patient? You know, aside from not being effective. I: That’s all that I have. E: Okay. And this is a spray. Okay. I: Yeah, it’s 200 micrograms. 120 units. For 30 days. E: And it doesn’t look like it’s going to have a problem with the quantity limitation. So is there any other clinical information you’d like to provide at this time? I: No, just that patient will remain on a long-acting opioid and patient is opioid tolerant. Other than that, I think we’ve covered everything. […] RESPONSE FROM INSYS The minority staff requested that Insys officials address whether the company implemented the recommendations in the CIS report or took any other action to address deficiencies in prior authorization policies. In response, Insys President and CEO Saeed Motahari provided a letter explaining that the company had “completely transformed its employee base over the last several years,” including in “key management positions,” and has “actively taken the appropriate steps to place ethical standards of conduct and patient interests at the heart of [its] business decisions.”59 Specifically, Mr. Motahari noted that Insys had “invested significant resources in establishing an effective compliance program with protocols designed to ensure compliant and ethical behavior”; the company also engaged an independent “gap assessment into [its] compliance protocols.”60 In closing, Mr. Motahari pledged “to play a positive and productive role in helping our nation overcome the opioid epidemic.”61 As part of its ongoing investigation, the minority staff will continue to evaluate whether these efforts have resulted in a true transformation of the Insys corporate culture. Letter from Saeed Motahari, Insys President and CEO, to Sen. Claire McCaskill (Sept. 1, 2017) (attached as Exhibit C). Id. 61 Id. 59 60 P A G E 11 CONCLUSION According to public reporting, lawsuits from Subsys patients, and criminal indictments, Insys Therapeutics has repeatedly employed aggressive and likely illegal techniques to boost prescriptions for its fentanyl product Subsys. An audio recording and other materials the minority staff has reviewed suggest these efforts have included actions to undermine critical safeguards in the prior authorization process—with Insys officials aware, at the very least, of the serious danger of these acts occurring. The high stakes of opioid overprescription—including patient death—demand close attention to these practices by law enforcement officials, policymakers, and the PBMs charged with approving or rejecting fentanyl treatment. The PBM Express Scripts excluded Subsys from its list of covered drugs in 2015, and UnitedHealth Group, which owns the PBM OptumRx, did the same in 2016.62 In December 2016, federal prosecutors indicted Mr. Babich and five other former Insys executives on racketeering charges, alleging that these individuals “approved and fostered” fraudulent prior authorization practices.63 In June 2017, Ms. Gurrieri, the former head of the IRC, pled guilty “to having conspired to defraud insurers.”64 On July 17, 2017, shortly after the filing of a complaint by Anthem insurance plans, Insys released a statement explaining that the company has “taken, and will continue to take, appropriate steps to learn from the past and to ensure that appropriate protocols and policies are in place at our Company.”65 As part of its ongoing investigation, the minority staff will continue to evaluate whether these efforts have resulted in a true transformation of the Insys corporate culture. The Pain Killer: A Drug Company Putting Profits Above Patients, CNBC (Nov. 4, 2015). Indictment (Dec. 6, 2016), United States v. Babich, et al., D. Mass. (No. 1:16 CR 10343). 64 Ex-Insys Employee Pleads Guilty in U.S. Opioid Drug Probe, Reuters (June 19, 2017) (www.reuters.com/article/us-insys-court-idUSKBN19A2MB ). 65 Insys Therapeutics, Inc.: Insys Therapeutics, Inc. Releases Statement on Payor Interactions (July 17, 2017) (www.globenewswire.com/newsrelease/2017/07/17/1047299/ 0/en/Insys-Therapeutics-Inc-Releases-Statement-on-Payor-Interactions.html). 62 63 EXHIBIT A HSGAC Fueling an Epidemic: Insys Therapeutics and the Systemic Manipulation of Prior Authorization - EXHIBIT A Fueling an Epidemic: Insys Therapeutics and the Systemic Manipulation of Prior Authorization - EXHIBIT A Fueling an Epidemic: Insys Therapeutics and the Systemic Manipulation of Prior Authorization - EXHIBIT A EXHIBIT HSGAC Fueling an Epidemic: Insys Therapeutics and the Systemic Manipulation of Prior Authorization - EXHIBIT B lnsys Call Note, Email, & IRC Verbatim Data Audit Report Presented to February 18th, 2014 By Compliance Implementation Services Ellis Preserve 3809 West Chester Pike, Suite 100 Newtown Square, PA 19073 ATIORNEY CLIENT PRIVELEDGED &CONFIDENTIAL Confidential INS4289760 INSYS_HSGAC_ 00007763 Fueling an Epidemic: Insys Therapeutics and the Systemic Manipulation of Prior Authorization - EXHIBIT B In sys Call Note, Email, & IRC Verbatim Data Audit Report Introduction .......................................................................................................................................................... 3 Project Objective and Scope .................................................................................................................................. 3 Project Methodology ............................................................................................................................................. 5 Specific Observations and Recommendations ........................................................................................................ 7 Conclusion .......................................................................................................................................................... 11 Page 2of10 Confidential Attorney Client Privileged & Confidential INS4289761 INSYS_HSGAC_00007764 Fueling an Epidemic: Insys Therapeutics and the Systemic Manipulation of Prior Authorization - EXHIBIT B In sys Call Note, Email, & IRC Verbatim Data Audit Report Introduction In mid 2013, CIS was approached by INSYS' legal representative (at that time Leslie Zacks) on behalf of the Board of Directors for INSYS to request that CIS support in the review of certain communications with Health Care Professionals (HCPs) and INSYS employees, and report how they were being documented. It was communicated at that time to CIS that there was concern with respect to communications with HCPs by INSYS employees being professional in nature and in alignment with INSYS approved topics regarding off or on-label promotion of an INSYS product, and general adherence to INSYS documentation requirements of these types of communications. It was also communicated to CIS that while there were no documented examples of this type of interaction to date, the concern stemmed from the lack of monitoring of commercial ac;tivlties where these types of interactions could occur This was to more specifically include a review of email communications that had occurred (if any) with HCPs by INSYS employees and the documen~ati.em process and quality of the call notes recorded after in office meetings with HCPs by INSYS employees nadbccurr~d. All of this was to be reviewed against existing INSYS policy and procedure that governed the f'lbdve discussed activities (if any), interviews with 1 senior leadership to understand more fully any directive given with respect to communications with HPC's, and verifying compliance to them. .. '~ I It was further requested that a review of the general communications from the INSYS Reimbursement Center (IRC) to HCPs, their office staff or representatives, as well ashe~lth insur~nce carriers occurtb ensure they were appropriate in nature with respect to spectificuses of SUBSYS, INSYS' commercially marketed product. All requests ultimately came together to provid¢ a t.horough review 'ofiniernal INSYS email communications with the top twenty (20) SUBSYS prescribing physicians; the calf notes that w~~e recorded post an INSYS employee visit with these specific twenty (20) HCPs, as well as ~rt onsitet~Vlew of IRB oper~tions that included interviews, live monitoring, and a review of existing policies and procedures {i{"anv) governin.gthe actions of those working within the IRC. I I 1 l:~ I CIS is pleased to present the following observations an~ re~ommendations found within this report. Project Objective an.(J !icope L Objective: .. · ·. . . . . . . .. . .. 1 The objective of this audit was to evaluate ania aysess the existence, adequacy, and comprehensiveness of INSYS's existing policycand procedural documentation tcN:ietermine whether adequate controls were in place to l effectively ensure C0fl1pliance and adh.erence to said documents, INSYS guidance, and industry best practices related to all forms of communication}rbm INSYS employees to HCPs. Specifically, the objective ofthi~ ~u~it, was to review sales representative call notes and other communications and documentation to ensureove:rsight of day-to-day promotional and non-promotional activities and to ensure prospective compliance with thelNSYS policies, procedures, and communicated controls (if any). Further, the objective of this review was to ensure that the IRC's communications were in alignment with INSYS and IRC specific policies, procedures, and communicated controls (if any) regarding interactions with HCP's, as well as on label with respect to product indication. HCP & IRC Scope: The project sponsors both Leslie Zacks and Desiree Hollandsworth at the request of the INSYS Board of Directors and in conjunction with the CIS team, narrowed the scope of the engagement to specifically target all communications, interactions, and documentation with the top twenty (20) prescribing HCPs for INSYS' Page 3of10 Confidential Attorney Client Privileged & Confidential INS4289762 INSYS_HSGAC_ 00007765 Fueling an Epidemic: Insys Therapeutics and the Systemic Manipulation of Prior Authorization - EXHIBIT B In sys Call Note, Email, & IRC Verbatim Data Audit Report commercially marketed product, SUBSYS. Further, the scope of data and document review of the IRC interactions with HCPs was to be narrowed to a random sampling of live phone calls, interviews with employees and management, and review of existing policy, procedure, and SOPs (if any) governing the actions of the IRC and its employees. Documentation, Interview, & Live Monitoring Scope: CIS reviewed the following policies and procedures that INSYS provided related to their internal requirements governing interactions with HCPs, the documentation of HCP visits within the INSYS Sales Force 360 platform (call note repository), and the IRC. CIS also collected functional data for the audit which is listed below. Finally, CIS scheduled interviews with the below listed INSYS employees to obtain a ret~er understanding of processes and requirements as they related to HCP communication and documentation both in the field and the IRC. It should be noted that during the on site IRC visit there were employees on, vacation and or out of the office, so multiple calls were monitored for the same employee. CIS would like to n~te th~tth~ recording and transcripts of the live monitoring session was not possible to obtain, as currently1NS Ys does no(have the ability to do so with its 1 current phone system. · · Compliance Program and Certificatiof) of Compliance Governance SOP #4 SOP #3 SOP #2 SOP #1 PPT - Training 30 Units f~ee and Super.::Vouchers ove(v\iew ofJR,C Impact Document PPT - Training PPT - Training Rfescription Process Flow Chart PA'+Workshop (~e,w, Hire Training ~nd Refresher Training) PPT - Training INSYS Employee Hajl.dbook Insurance Reimbutsemeht Center Communi·cation Process INSYS Reimburseme.nt Center 1Li ne INSYS Reimbursement Center 1 1 Internal o~.umerlt Internal t:Jot:ument Internal Do<:u ment Corporate;Email PPT - Training PPT - Training PPT - Training HCP Data Call Notes Data Corporate Email Data IRC Sales1Forc~ Tni!.ining New Opt-'ln fprm !RC Plow Chart-Appeal Process IRCF'low Chart -P.A Process Multiple lhternal IF{C(f;mails with directives from management on numerous topics Revised Core Speaker Oe'ck Supplementa(Speaker Deck Slides ·~ew Sales Force Training curriculum TO:i:;> twenty{~O) HCP Prescriber data excel files (2) AlLcall nQ:te·s1associated with the top twenty (20) HCP Prescribers for 2013 Email c.qmmunications associated with the top twenty (20) HCP Prescribers -2013 Marketing/Communication Leslie Zacks - Legal Maury Rice - IT Mike Gurry - Managed Markets (IRC) Liz Gurrieri - Managed Markets (IRC) Page 4of10 Confidential 1 October 2i , 2013, November 1st , 2013, December 19 2013 October 2i , 2013 December 19t , 2013 December 18th' 2013 December 18t , 2013 Attorney Client Privileged & Confidential INS4289763 INSYS_HSGAC_00007766 Fueling an Epidemic: Insys Therapeutics and the Systemic Manipulation of Prior Authorization - EXHIBIT B In sys Call Note, Email, & IRC Verbatim Data Audit Report I December 19th, 2013 I Darin Fila - Sales Training 1111' w - Sam Renzetti Traci Giles Allyson Fulton December December December December 13t , 13t , 13th' 13th, 2013 2013 2013 2013 Patricia Ray Nixon Patricia Ray Nixon Sam Renzetti Traci Giles December December December December 19t , 19th' 19t , 19th, 2013 2013 2013 2013 Allison Fulton Traci Giles December 19t ~ 2013 Project Methodology I The audit focused on evaluating any existing written documentation that:, governs appropriate communication , .. - L .. -With HCPs as an INSYS employee and whether, or. not there aread~qu~te controls in place that effectively ensure compliance and adherence with said documenta~ion, INSYS guidan"ce,' and industry best practices related to HCP communication and interactions. The methodology outlined below was used for t~e Call Notes,. Email, and IRCVerbatim Audit Report: ~ ,,, I ' ' • • I I FIELD WORK & GENERAl ()~SERVAllONS • Document Collectl"n, Review, a11d Interviews 1 CIS collected and reviewed variou:s:uocuments pr9vided by INSYS as well as carried out interviews with key stakeholders to bett~r .understand ~pecific pr6:acttal entries were not found. • Identified the lack of F~r~I andAp~rQved Governance Documentation, Policy, Procedures, and SOPs CIS identifie d that while O()(:umentation1with respect to communication and inter actions with HCPs existed, ther~ were also gaps in formally approved foundational policies, procedures, and SOPs with respect to required processes specifically within the IRC. CIS also ide ntified the lack of a formal policy with respect toemail commu11ic ation from a sales representative to an HCP and the appropriate and approved methods by whic!'l they are to occur. 1 I . I • Identified the Absence oftm Auditing & Monitoring Function Within Multiple Business Units as Well as Through Interviews with Key INSYS Stake Holders During the interviews held with INSYS employees, it was apparent that no quality assurance processes were in place to monitor or audit the actions of sales representatives with respect to a timely call note record creation of an HCP visit within the Sales Force 360 platform. Further, there were no plans communicated to CIS with respect to implementing an auditing and monitoring function to ensure adherence to communications wit h this action. Further, through interviews it was apparent that no specific email monitoring process was in place and documented with respect to corporate email communication and HCPs in general, and specifically those that may occur f rom a field sales Page 6of10 Confidential Attorney Client Privileged & Confidential INS4289765 INSYS_HSGAC_ 00007768 Fueling an Epidemic: Insys Therapeutics and the Systemic Manipulation of Prior Authorization - EXHIBIT B In sys Call Note, Email, & IRC Verbatim Data Audit Report representative to an HCP. Finally, through interviews with the IRC management, there was no formal, documented, or detailed process by which IRC representatives ' calls via telephone were audited for proper communication with HCPs or HCls in any fashion other than random physical review of a call in a very informal and sporadic manner. Specific Observations and Recommendations Based on the audit procedures performed that related to the Verbatim D~ta Audit Process, CIS is providing the following specific observations and recommendations identified as a r'~su)t of the review and audit performed. I All observations and recommendations are based on complianc,e p~v:e~a~e for adherence to INSYS communicated guidance, policies, and SOPs, as well as benchmarking against industry best practices. I Observation #1: Upon reviewing the training curricylu1 with respect to sales representatives entering in call notes post an HCP visit, as well as any associated written requirements, interviews with INSYS Marketing Communication and Sales Training employees, the foflofing observations were made: , I. • • Observation 1-1: While sa.les representativesrarerequir,ed to record a call note.for each visit made to an HCP, governanc:fd~cumentation and tr,it''ling generally lack spe2ificity on the time frame a representative has~°" irtpl,.lf the call note by •. ··· Recommendation 1-1: The requirernenttq input a call note for an HCP visit within an INSYS approved time frame should pronbunqed dl,lring traihings, and specifically called out within proceduralguidance for inputting HCP call no~es. It is recor'nmended that a "Documentation of HCP Commuri1catirirt" SOP be created, ap~rpVied,af:!~ disseminated. bel ••• • i .1 I . I. ·.. .• . I Observat:ion 1-2: No formal auditing ariQtnonitoring process currently exists to ensure that sales representatives 7re inputt,ingcall notes within a specified time frame post and HCP visit. • Rec.ommendation!1-2: CIS recqrn~ends thata job description and requirement be added to DfstrictMariagersa.nd above to Pe~.iodic;ally review the call note input date within the Salesforce 360 platfo~mt() en;ure th,at they are irrallgnment with INSYS requirements for call note creation post an HCP visit •. These audits to be retained for performance review issues, further training when deemed rrehessary, and ii) some cases disciplinary action. I Observation #2: UpJninitiating the cbrporate email review and assessing how to query any communication from INSYS employees with the top twenty.~tO} HPC prescribers of SUBSYS, it became apparent that due to the extremely high volume of e~ail sefr~M hits that came back under keyword queries, (all of which consisted of internal emails discussing HCP e:ngagements or mention of the HCP's name) a random sampling of each of the twenty (20) top HCP SUBSYS prestribers would serve as a more realistic sample. The randomly sampled emails were reviewed for adherence to INSYS communication and interactions with HCPs documentation, as well as specific INSYS communicated guidance with respect to email communication and HCPs. Many multiple thousands of emails were produced over a year's time frame, which presented a challenge for the IT department when searching and categorizing them. For the size and scope of this particular review, CIS chose to randomly sample one hundred (100} emails from each of the top twenty (20) HCP SUBSYS prescribers to ensure all communication was in alignment with INSYS policy, procedure, and appropriate in nature. Page 7of10 Confidential Attorney Client Privileged & Confidential INS4289766 INSYS_HSGAC_00007769 Fueling an Epidemic: Insys Therapeutics and the Systemic Manipulation of Prior Authorization - EXHIBIT B In sys Call Note, Email, & IRC Verbatim Data Audit Report Out of the two thousand (2000} randomly selected emails (100 for each of the top twenty (20) HCP prescribers of SUBSYS); no direct email was found between a sales or field representative and an HCP. Any direct email communication with the HCP was engaged by a member of the Marketing, Executive, or Senior Management team and found appropriate in nature. CIS would like to note that the majority of reviewed emails consisted of internal INSYS discussions with respect to that particular HCP and all appropriate in nature. Recommendation: Although no inappropriate communication or violation of INSYS policy around HCP communication was found, CIS does recommend that a corporate compliance auditing and monitoring function be created and implemented to ensure periodic reviews of HCP email communication as on ongoing monitoring activity. This will ensure a much more up to date picture of communicatiot:1sbetween HCPs and INSYS employees in general, and also serve to satisfy the Office of Inspector General's sp~Ftfied element of an effective compliance program, by have this function ongoing. CIS also recommends that "'('hif!F~ sections of the INSYS Employee Handbook and Code of Ethics do discuss appropriate interactions with HCPs1 a separate and distinct 11 lnteractions ~ ' "1 with Health Care Professionals" policy should be drafted and disseminated company wide. • Observation 2-1: During the interview proceS:s;,:l1s learned that INSYS field sales representatives are prohibited from emailing HCPs, and comrrmnication was to be restricted to In-person, telephone, or text messaging only. There was no policy follnd to support this requirement,. ; • Recommendation 2-1: A separate and distinct policysholjlel be created that outlin,es the approved methods of communication with 1HCPs as they relate tp 1.N~YS employees, and specifically the sales representatives to ensure accoi.lntal;!Hity and establish' a ba.seline standard of communication that can be measured. ' • Observation 2-2:. No for,mal auditing and monitOrilllg pro~ess curr~ntly exists to ensure that email • Recommendation 2-2: CIS recommends that l~SYS incorporate and auditing and monitoring function, communications1:>Jtween1l-KPs and INS:)'Semploy~s'ar~ both apprepriate and professional in nature, as well as being init[ated and sents9l~ly by an authorizeid INSYS employee. 1 as well as system ca,ntrols wtt 1hln the corporateemail server that can notify appropriate levels of ma.~agement when a key 'ford °,rtiCP name isscanned. This will serve as a monitoring tool for C0!1'1-P,liance to communication standa~ds as they relate to HCP interactions. Observation #a: CIS observed that there wasa specific lack of formal and approved policies, procedures, and SOPs that govern the actions of thJJRC. Upon review of submitted IRC documentation and interviews held with IRC representatlV~s,.the following ol9s~rvations Were made: • Observation 3~1: No form1r ~nd approved policy on appropriate communications between IRC • employees and HCPs, their staff, HCls, or patients exists (or wasn't supplied to CIS for review) that governs the suppo* fOnctfon of obtaining a prior authorization for the use of SU BSYS. Recommendation 3.:.1: · 1NSYS IRC management to formally draft and obtain proper review and approval of an IRC specific policy detailing the appropriate communications that should occur while performing the IRC associate job functions and interacting with HCPs. • Observation 3-2: CIS observed that four (4) informal SOPs existed (see document scope section) but lacked a formal review and approval, as well as specificity with respect to the referenced topic. CIS noted that the documents were most likely white papers or narrative flow charts of processes, but no formal and approved SOPs exist (or weren't supplied to CIS for review) that outline appropriately the actions performed within the IRC. Page 8of10 Confidential Attorney Client Privileged & Confidential INS4289767 INSYS_HSGAC_00007770 Fueling an Epidemic: Insys Therapeutics and the Systemic Manipulation of Prior Authorization - EXHIBIT B In sys Call Note, Email, & IRC Verbatim Data Audit Report • Recommendation 3-2: INSYS IRC management to formally draft and obtain proper review and approval of IRC specific SOPs that in a detailed and action specific manner will govern all processes engaged within the IRC. INSYS IRC management should ensure these SOPs are specific to each job function within the IRC and that once formally reviewed and approved, adequate training and understanding of these processes exists. • Observation 3-3: While a quality control function does exist with respect to IRC documentation • regarding the Opt-in program and patient file information, no formal and documented auditing and monitoring or quality control policy, process, or function exists between IRC employee communications and HCPs, HCP staff, HCls, or patients. ] Recommendation 3-3: INSYS IRC management to formally tlraft and obtain proper review and I approval of an IRC Auditing & Monitoring specific policy ~nc;l .SOP. Further a specific schedule to monitor both live and anonymously IRC employee comm~nications both incoming and outgoing and at any given time should be created and adhered to. this functl6n will serve to ensure adherence to 1. • .;.I IRC communication standards and serve as suppor;ting documentation for training, annual reviews, and if necessary disciplinary action. It is re~on:frnended that the INSYS l~C i~plement an electronic system that will allow management to listen to calls in real time to ensure total anonymity. I I I Observation #4: Upon review of submitted {~CflocumentationLCIS requested all governancedbcumentation in general that could be reviewed), CIS noted the tdftowing: • • Observation 4-1: The majority of maf\~geri~lti~rectives, cha~ges to controlled documents or templates, as well. as updates or revisions to processes were nelt!formally approved, documented, and disseminated for O$e