In Case You Missed It: Regulatory and Enforcement Trends in Consumer Health

Consumer demand for health and wellness products has seen vast growth in recent years. The COVID-19 pandemic and its aftermath has also resulted in broader avenues through which consumers can obtain these products and services, including e-commerce, social media, and digital health apps. Consumers, however, are not the only ones interested in these products. In late 2022, both the Federal Trade Commission (FTC) and the Food and Drug Administration (FDA) have issued guidance documents, initiated new rulemaking, and engaged in enforcement activities directly affecting the consumer health industry. State agencies and enforcers have likewise focused their attention on consumer health products, particularly with respect to protecting private health data and consumer injury from auto-renewal subscription-based programs.

To that end, this Advisory provides a summary of key regulatory and legal developments affecting the consumer health industry, focusing specifically on the following:

• FTC’s recently issued Health Products Compliance Guidance;
• Federal and state focus on the protection of privacy and personal health data;
• Increasing regulatory and enforcement focus on auto-renewing subscription models; and
• Recent notable FDA regulatory actions concerning consumer health software products and homeopathic drug products.

The Advisory then closes with key takeaways for companies to help mitigate risk for their consumer health portfolios under the current regulatory regime.

FTC’s Health Products Compliance Guidance

The FTC shares jurisdiction with FDA over the marketing of health-related products. Pursuant to a memorandum of understanding between the two agencies, FDA has primary responsibility over claims that appear on labeling, while the FTC has primary responsibility for claims made in advertising. While both agencies require health-related promotional claims to be truthful and substantiated, companies should note that the FTC does not distinguish between categories of health-related products (e.g., drugs vs. dietary supplements) in evaluating advertising claims. Rather, according to the FTC, “the FTC’s approach to the advertising of health-related products is the same regardless of whether, under FDA law, the product is considered a food, a supplement or a drug.” The FTC has also been clear that the memorandum of understanding does not limit the FTC’s jurisdiction or preclude the agency from taking action against deceptive labeling claims or prescription drug promotion. The past two years have included notable FTC pronouncements of its authority over pharmaceutical marketing, including its inclusion of multiple health-related drug marketing examples in its proposed updates to the Guides Concerning the Use of Endorsements and Testimonials in Advertising (the Endorsement Guides). Further signaling its current focus on all health-benefit claims, the FTC issued a new Health Products Compliance Guide on December 20, 2022, replacing the agency’s prior 1998 guidance document, “Dietary Supplements: An Advertising Guide for Industry.” While the guidance does not have the force or effect of law, the FTC explains that the principles and examples provided in the guidance are “intended to help advertisers comply with the basic tenets of FTC law.”

Most notably, the new guidance has been expanded to apply to all products promoted with health-benefit claims. The guidance includes examples that cover a broad range of products, including conventional food, drugs, and medical devices, while also covering the diverse media through which health-related claims are communicated to consumers, including smartphone apps, social media, and other forms of online digital advertising. The guidance imposes stricter standards on advertisers than, in some cases, applied by FDA or reflected in prior FTC guidance and case law. For this reason, every company engaged in the marketing and promotion of consumer health products should re-evaluate their current risk assessments against this new guidance document.

Key call-outs from the guidance on expectations of advertisers include:

• Identify (and Substantiate) Implied Claims—The guidance goes into detail regarding advertisers’ responsibility to substantiate both express and implied claims conveyed by their advertising. In discussing the legal obligation, however, the FTC suggests advertisers may need to preemptively conduct consumer perception testing on advertising to confirm the messages conveyed by such advertising. The FTC also discusses the many ways in which implied claims can be conveyed in advertising, including by use of product names, before and after photos, or other imagery. Most notably, the FTC explicitly takes the position that certain literally true claims, such as “cardiologist recommended” and “clinically tested” may convey broader messages such as that the “cardiologist recommended” product is also good for the heart or that the “clinically tested” product is proven by such test to provide specific benefits.
• Disclose Side Effects, Potential Drug Interactions, or Other “Material” Qualifying Information—It is well established that, under the FTC Act, an advertisement is misleading if it fails to disclose information that is material in light of the claims in the advertisement or with respect to how consumers customarily use the product. In the Health Product Compliance Guidance, the FTC expresses its interpretation of this legal obligation further, taking the position that health product advertising (including for food, dietary supplements, and OTC drug products) should disclose information regarding the side effects or contraindications for the product if:

• the product can result in a “potentially serious risk” (such as a significant increase in blood pressure);
• is contraindicated with drug products; or
• is claimed to have fewer side effects than another product (or category of products).

This guidance may be a step further than the “use only as directed” disclosure approach used by many companies marketing consumer health products. The FTC also takes the position that (1) a company marketing a product that addresses a symptom (e.g., snoring) that is often associated with a disease (e.g., sleep apnea) should disclose in advertising that the product does not treat the disease and (2) advertising for a product that addresses an issue that only affects a small percentage of the US population should disclose that only a small percentage of people will benefit from the product.

• Ensure Disclosures Meet the FTC’s Modernized Clear and Conspicuous Standard—In the guidance, the FTC states that, where disclosure of qualifying information is necessary, such disclosure should be presented clearly and conspicuously, so “it is difficult to miss (i.e., noticeable) and easily understandable by ordinary consumers.” In particular, the FTC takes the position that if the claim that requires disclosure is made both visually and audibly, then the disclosure must likewise be made both visually and audibly. The FTC also notes that in social media, the internet, and other interactive media, the disclosure should be unavoidable and that the agency considers hyperlinks to be avoidable;
• Reconsider Making Claims Based on Emerging Evidence—The guidance discourages use of promotional claims based on “emerging evidence” stating, “it is very difficult to adequately qualify a claim based on limited and still-emerging science to make clear to consumers the uncertain and limited nature of the support for the claim.” The FTC goes on to state that the words “promising,” “preliminary,” and “may” are “unlikely to sufficiently convey the limitations of . . . science”;
• Understand RCTs Are “Typically” Required for Health-Benefit Claims—The FTC guidance puts forth a rigorous substantiation standard for health-related claims. The guidance references the Pfizer factors and the “competent and reliable scientific evidence” standard—which is defined as “tests, analyses, research, or studies that (1) have been conducted and evaluated in an objective manner by experts in the relevant disease, condition, or function to which the representation relates and (2) are generally accepted in the profession to yield accurate and reliable results.” The FTC Guidance also makes clear that “where there is an existing standard for substantiation developed by a government agency such as the FDA or the National Institute of Health, or another authoritative body such as the National Academy of Sciences, the FTC gives great deference to that standard.” The FTC, however, does not acknowledge that some of these authoritative bodies' substantiation standards, such as those for the OTC monograph and 510k pathways to market, do not require clinical testing. To the contrary, the FTC goes on to state that “as a general matter, substantiation for health-related benefits will need to be in the form of randomized, controlled human clinical testing (RCT) to meet the competent and reliable scientific evidence standard." The agency also takes the position that, while potentially valuable to show an association between a product and benefit, neither epidemiological (or observational) studies, animal studies, nor in vitro studies are sufficient to substantiate health-related claims without confirmation from human RCTs.
  
  The FTC’s RCT standard as stated in the guidance is a shift from the flexibility included in the formal definition of competent and reliable scientific evidence, as it fails to acknowledge other “tests, analyses, and research” can also be “generally accepted in the profession to yield accurate and reliable results” regarding a product (or product component’s) efficacy (affirmed by United States v. Bayer Corp., No. CV 07-01(JLL), 2015 WL 5822595 (D.N.J. Sept. 24, 2015). For this reason, the RCT standard as stated in the guidance should be on the radar of all companies, and may warrant prompt re-evaluation of current claim support by companies interested in avoiding FTC enforcement; and

• Monitor the Quality of the Evidence and the Study Report—The FTC highlights the importance of the internal validity of each piece of evidence provided to support a health-benefit claim. The FTC advises marketers to ensure the research on which they rely complies with the following basic principles:

• The human clinical trial should have both a treatment group and a control group;
• The study should be randomized;
• The study should be double blinded;
• The study should yield statistically significant results; and,
• The statistically significant results should translate to a benefit that is clinically meaningful.

The FTC also emphasizes that research intended to support a claim “should begin with a clear and defined protocol” and subsequently details the elements of claim support that the FTC believes evidence the results of such research is “clinically meaningful.” Key elements include pre-disclosed primary and secondary endpoints, submission of the research protocol to an institutional review board, an intent-to-treat analysis, sufficient duration to ensure any touted benefits will persist, and a study write-up that contains “sufficient detail to assess what actually took place.”

Regulatory Focus on Privacy and Personal Health Data

The FTC’s Health Products Compliance Guidance invokes a rigorous standard for claim support that should be closely reviewed by any company engaged in health-related marketing. The FTC’s focus on health products, however, is not limited to health-benefit claims. In January of last year, the FTC made its related focus on privacy known when it issued guidance that expanded the scope of its Health Breach Notification Rule. The Health Breach Notification Rule requires notification of certain unauthorized acquisitions of health information to the individual, the FTC, and possibly others. On its face, the Health Breach Notification Rule appears to be limited to those entities who compiled health records from healthcare providers but were not covered by the Health Insurance Portability and Accountability Act (HIPAA). However, the FTC guidance and related policy statement makes clear that the FTC seeks to have health apps, fitness trackers, wellness apps, and others (including those entity’s vendors, such as the cloud storage companies that support those vendors) in the consumer health space report breaches to the FTC under the Rule. This is critical because the FTC often uses notifications of breaches to determine enforcement priorities under its Section 5 authority. Further, this position aligns with other statements the FTC made last year to show its commitment to protecting health information, and we expect to see an enforcement focus this year.

The FTC is not the only one looking to better protect consumer health. All of the new US state consumer privacy laws categorize health data (broadly defined by some laws as any information related to a consumer’s health) as sensitive data and subject sensitive data to strict requirements for consent to process in many circumstances or to easily enforceable opt-outs of processing sensitive health data.

The federal government has also been looking for ways to better protect health data. For example, in the past year, Congress has introduced a number of bills, including the Health Data Use and Privacy Commission Act and the My Body, My Data Act. While none of the laws have passed yet, the number of laws introduced shows Congress’s focus on the issue of health data protection. Moreover, these bills may gain further traction in the new Congress and, combined with President Biden’s Executive Order directing the Department of Health and Human Services and the FTC to take steps to protect health information and prevent privacy violations, demonstrate a concerted effort to prioritize the protection of private health data.

Health-Related Auto-Renewing Subscriptions

Consumer health companies that offer subscriptions for products or services are also at risk of drawing scrutiny, not only from plaintiffs’ lawyers, but from federal, state, and local enforcers. Many states have very detailed requirements for automatic renewals, covering such issues as font size, placement of disclosures, confirming emails, notice before renewal payments, and cancellation methods. The FTC and state and local prosecutors have been devoting significant resources to investigate design tactics known as “dark patterns” that purportedly trick consumers into enrolling in subscriptions by providing inadequate disclosures and notice, and then trapping them with difficult-to-find, lengthy, or confusing cancellation paths. These investigations have led to a flurry of hefty penalties. For example, in January 2023, the FTC returned payments totaling $973,000 to consumers who the agency alleges lost money after a digital health company enrolled them in unwanted membership programs for supplements and beauty products.

Against this backdrop, consumer health companies that provide auto-renewal or subscription-based products or services should ensure an assessment of auto-renewal laws has been conducted to confirm:

• Strict compliance with the relevant FTC and state statutory requirements, including notification requirements;
• Clear and prominent disclosures of auto-renewal terms before customers affirmatively consent to subscriptions;
• Adequate disclosures regarding the price that will be charged after a free or promotional trial ends;
• Adequate notices for renewal before the expiration of a free or promotional trial; and
• An easy-to find cancellation path that does not obstruct or delay customers’ ability to cancel.

Technical violations of these rules can lead to state and federal inquiries.

FDA’s Regulation of Consumer Health Software Products

Recent months have also reflected much activity from FDA pertaining to software-based products, including consumer health software products. Material developments in this area include, but are not limited to, the following:

• issuance of several important revised and final digital health guidances;
• finalization of several classification regulations for novel digital health tools (e.g., new classification for virtual reality pain relief devices);
• release of a list of FDA-authorized devices that employ virtual reality or augmented reality, as well as an updated list of devices that employ artificial intelligence (AI) or machine learning (ML);
• the end of FDA’s software precertification program due in part to lack of statutory authority to implement the program in the manner proposed by FDA; and
• inclusion of provisions governing cybersecurity requirements for “cyber devices” and change control plans for AI/ML devices as part of the FDA-focused riders included in the Consolidated Appropriations Act of 2023, signed into law on December 29, 2022.

While all of these developments are noteworthy, companies marketing consumer-focused digital health products should pay particular attention to FDA’s recent digital health guidance updates as they have the potential to affect the regulatory status of certain currently marketed consumer health products. In September 2022, FDA issued a long-awaited final version of a guidance governing the regulation of clinical decision support (CDS) software as medical devices (Final CDS Guidance). As amended in 2016 by the 21st Century Cures Act (Cures Act), the statutory definition of a “device” excludes certain lower-risk software functions, including certain CDS software functions. FDA previously issued draft guidance explaining the agency’s interpretation of the Cures Act criteria for exempt non-device CDS functions in 2017 and issued a revised draft guidance in 2019 (Draft CDS Guidance). The Final CDS Guidance differs in important ways from the Draft CDS Guidance and suggests FDA intends to take a more expansive view of CDS software functions subject to agency oversight. Significantly, the Final CDS Guidance eliminates the enforcement discretion policy for certain low-risk patient and caregiver device CDS functions described in the Draft CDS Guidance. Although FDA interprets the Cures Act non-device CDS exemption as being limited to qualifying CDS functions intended for healthcare providers (HCPs), the Draft CDS Guidance articulated that the agency did not intend to enforce compliance with device requirements for certain device CDS functions for patients and caregivers for non-serious diseases or conditions under certain circumstances. The Final CDS Guidance does not include this enforcement discretion policy nor the enforcement discretion policy for low-risk device CDS functions for HCPs that fail to qualify as a non-device under the Cures Act criteria. In the Final CDS Guidance, FDA indicates that such CDS functions are considered medical device functions, but notes that certain such functions could fall within the scope of enforcement discretion policies described in other existing FDA digital health guidance.

On October 18, 2022, FDA officials hosted a public webinar to discuss and answer questions about the Final CDS Guidance. FDA officials confirmed that the Final CDS Guidance does not contain the enforcement discretion policies described in the Draft CDS Guidance, but reiterated that enforcement discretion policies in other FDA guidance could apply to certain device CDS functions. For example, the agency suggested that certain CDS software tools could fall within the enforcement discretion policy for software functions that “help patients (i.e., users) self-manage their disease or conditions without providing specific treatment or treatment suggestions” described in FDA’s Policy for Device Software Functions and Mobile Medical Applications. FDA recommended that developers with questions about the regulatory status of their CDS tools under the Final CDS Guidance contact the agency or consult FDA’s new Digital Health Policy Navigator resource.

In light of the guidance changes and ambiguities, for some companies, a strategic “presubmission meeting” or other engagement with FDA may be prudent. To that end, there has also been a trend towards companies that receive Warning Letters for marketing digital health products without FDA clearance or approval subsequently working with the agency to obtain marketing authorization and bring their products into compliance with FDA requirements. For example, a notable recent FDA marketing authorization in the digital health space is the 510(k) clearance for Visibly’s online visual acuity test. On August 12, 2022, Visibly received 510(k) clearance for the “Visibly Digital Acuity Product” (VDAP), as a web-based, self-guided software application intended for use by adults (ages 22 to 40) who have the capability to perform a self-test at home to aid in the evaluation of visual acuity with or without correction. Visibly, which formerly operated as Opternative Inc., previously marketed a mobile app-based online eye examination test without FDA marketing authorization. In October 2017, FDA issued Opternative a public Warning Letter in which the agency asserted marketing of the test without clearance or approval violated the Federal Food, Drug, and Cosmetic Act (FDCA). Receipt of 510(k) clearance for the VDAP indicates Visibly worked with the agency to bring its test into compliance with the FDCA and obtain the necessary marketing authorization. In a press release announcing the clearance, Visibly describes its test as the “first FDA-cleared online visual acuity test on the US market.”

Another notable example is Owlet Baby Care, Inc. (Owlet), which, back in October 2021, received a Warning Letter from FDA alleging the company’s Smart Sock products are devices. While an “FDA Response” section on Owlet’s website explains that Owlet is “no longer selling the Smart Sock in the US,” Owlet now appears to be working with FDA to obtain two marketing authorizations. Most recently, in a December 22 press release, Owlet announced that it submitted a de novo classification request for “an over-the-counter software-as-a-medical-device that offers heart rate and oxygen displays and notifications in conjunction with Owlet’s existing Dream Sock sleep monitoring capabilities.” The press release explains that the de novo request is Owlet’s second FDA submission this year, with the company announcing in October that it submitted a 510(k) pre-market notification for a prescription-only monitor designed to be used in-home for babies under the supervision of a physician.

FDA’s Guidance on Homeopathic Drug Products

Finally, consumer health companies whose product portfolios include homeopathic products should also note FDA’s recent final guidance document outlining how the agency intends to prioritize enforcement and regulatory actions for homeopathic drug products marketed in the US. In 2019, FDA withdrew its longstanding Compliance Policy Guide (CPG 400.400), entitled “Conditions Under Which Homeopathic Drugs May be Marketed” after finding it to be inconsistent with the agency’s risk-based approach to regulatory and enforcement action. The agency cited consumer safety risks as a major reason for updating its guidance, explaining that it had “encountered situations in which homeopathic products either caused or could have caused significant harm, even though the products, as labeled, appeared to meet the conditions described in CPG 400.400.” FDA also highlighted that consumer use of homeopathic products had grown significantly since CPG 400.400 was issued back in 1988, further reinforcing FDA’s enhanced focus on this category of products.

FDA’s new guidance, which was issued in December, makes clear that the agency intends to apply its risk-based enforcement approach to homeopathic drug products marketed without the required FDA approval. In particular, the guidance identifies the following categories of products that FDA has identified as posing higher risks to public health and for which the agency intends to prioritize its enforcement and regulatory actions:

• Products with reports of injury that, after evaluation, raise potential safety concerns;
• Products that contain or purport to contain ingredients associated with potentially significant safety concerns;
• Products for routes of administration other than oral and topical, such as injectable or ophthalmic drug products;
• Products intended to be used for the prevention or treatment of serious and/or life threatening diseases or conditions;
• Products for vulnerable populations, such as immunocompromised individuals, infants and children, the elderly, and pregnant women; and
• Products with significant quality issues, such as products made in facilities with significant deviations from Current Good Manufacturing Practice requirements.

Key Takeaways

The developments outlined in this Advisory are an important reminder that consumer health products face significant regulatory scrutiny that warrants reassessment of the risk profile associated with the marketing of such products. Against this backdrop, it would be prudent for any companies engaged in the development or promotion of health products and services to consider the following steps to help mitigate risk to their company:

• Vet claim support against the FTC’s Health Products Compliance Guidance and FDA’s guidance on homeopathic products, including a gap assessment between current claim support and the standards outlined in the guidance;
• Confirm whether the team is developing any subscription-based products and, if so, that the program has been vetted for compliance with federal and state laws governing auto-renewal programs; and
• Reassess the regulatory status of software-based products based on FDA’s new guidance.

Our team has extensive experience representing companies that are engaged in the development and marketing of consumer health products and will continue to monitor enforcement trends affecting the consumer health industry. In the interim, please reach out to any of the authors listed, or your regular Arnold & Porter contact, with any questions about the topics discussed in this Advisory.

© Arnold & Porter Kaye Scholer LLP 2023 All Rights Reserved. This Advisory is intended to be a general summary of the law and does not constitute legal advice. You should consult with counsel to determine applicable legal requirements in a specific fact situation.