Ready to Law-nch: Compliance as a Competitive Advantage

Welcome to the very first episode of Ready for Launch: Startups in Regulated Spaces. I'm Dave Liss, your host and producer, and together with my co-host, Dennis Sapien-Panjindian, founder of DSP Advocates, a law firm providing bespoke advocacy for founders, entrepreneurs, startups, and small businesses. We're here to help founders and business leaders understand the hidden legal and compliance challenges that can make or break their startups. In every episode, you'll get two things: the compliance play—what the law requires—and the business play—how you can leverage that requirement into a growth advantage. And finally, the launch code—the key takeaway from each episode. If you're an entrepreneur with a big idea in healthcare, life sciences, or any regulated space, this podcast is for you. Please take a moment to follow, rate, and share this show. It helps us reach more founders just like you. Our first guest is my co-host, Dennis Sapien-Panjandian, an attorney with deep experience in healthcare and life sciences, regulatory investigations, and compliance. He's worked inside the U.S. Department of Health and Services Office of the Inspector General, or OIG, the largest watchdog agency in the federal government, and now advises startups and established companies on navigating some of the toughest regulatory challenges in business., and I'm Dave Liss. I've spent over 20 years producing podcasts, events, and healthcare communication strategies for global organizations and businesses around the world. I'll be asking the questions founders are thinking about and making sure our conversations stay practical, actionable, and focused on helping you grow. Dennis, let's start with the big picture. Why are startups in healthcare and other regulated industries so different from startups in unregulated spaces like software or retail.

Thanks, Dave. Thanks for having me here. I'm excited to be doing this with you. It's, it's really great. So this is really important to understand, right? Because the healthcare and life sciences industry is going to be unlike any other industry that we're aware of. There's a lot of things that are really counterintuitive to very common business practices, right? There is, for instance, you know, if you own a car dealership and someone I send you a customer and you sell to that person, I'll give you 10% off of every car I sell because you send me a customer. That's a common business practice in regular industries, right? But in healthcare, that's illegal. That could actually land you in jail and that could take away your freedom. So those types of things that are counterintuitive are, are really, they're really landmines all over the place, everywhere from how you're paid if you're a physician to different arrangements that you can enter into if you're an entity, to even just how you're using data if you're a tech company, right? So I think there's just so many risks abound that you really need to start thinking about what compliance looks like from day one. It even needs to be built into your own product design in several instances.

So like if I'm thinking about an entrepreneur like Bill Gates starting out in the garage somewhere. When do they need to have this on their radar as they're building a product or service?

I think if, especially if you're going into tech, if you're using, if you're going into medical devices, it needs to be from day one. It needs to be built into the DNA of your item or service, whatever your product is. And just to give you a sense of why, Dave, let me just read off a little bit about the context of healthcare and life sciences in the US. If you think about it, The healthcare and life sciences industry is one of the largest regulated spaces in the US, probably the most regulated space maybe outside of like the nuclear industry. And to get a sense of why, like, think about how many people are on Medicare, Dave. There's— I was looking at some data and in 2022, 1 in 5 Americans were on Medicare. That's 20% of the US population. And then you think about Medicaid,, right? That's 23.5%. Almost a quarter of all Americans were on Medicaid in 2022. Now, you know, we could talk about politics and anything, put all that aside, but just thinking about resources and like the vast cost of it all for that many people on these federal healthcare programs. And Medicare, you know, in 2023, spending was around $840 billion. In 2024, it went up to $1.1 trillion. Now in Medicaid, there was about $620 billion spent on Medicaid in the US alone, right? And then that by the US federal government. Now because Medicaid is a partnership between the federal and state government, that number actually, the total amount increases to almost $900 billion in 2023 alone, total spending between federal and state governments. So Think about that. That's $1.1 trillion in Medicare, almost a trillion in Medicaid. That's $2 trillion of taxpayer funds being spent on these federal healthcare programs. And what the government is concerned about is what they'll say is healthcare fraud and abuse. And, you know, there's an estimate out there that says in 2024, there's an estimated $87.1 billion of that federal healthcare spending that's lost to fraud and abuse. And that includes just nefarious fraud, but also just improper payments because people were non-compliant.

Are there 1 or 2 questions that are true you could consider triggers that if you can answer these 2 questions, yes, you are involved in healthcare or life sciences?

Yeah. I mean, so I think the biggest question is, is your product or service reimbursable by Medicare or Medicaid? I think that's the biggest thing, right? Because so much of these federal healthcare fraud and abuse laws, that is the main crux if you are receiving reimbursement by federal healthcare programs. But that's not it, right? I think how is your product going to be used? Is it going to be used for the diagnosis or treatment of a medical, of a medical condition? Are you going to be receiving patient data? So I think those are like 3 good places to start to think about if, if you need to start thinking about healthcare and life sciences compliance.

What is the number 1 mistake that you feel that most founders make when it comes to compliance?

I think it is that they could DIY it, right? Because a lot of entrepreneurs, a lot of these innovators, they're great. They're great people. They want to change the world. They, they have this radical idea and they want to do good. Most of them really, really who enter this space, yes, there's profit to be made, but more importantly, they, they really just want to save lives, improve lives. And, but they think that they have this great idea and it's super innovative and that's awesome, but compliance isn't something that could be DIYed in your garage because the regulatory scheme is so wide. And Dave, I don't know if you want to spend a few minutes just talking about the alphabet soup of healthcare fraud and abuse regulation.

I think that'd be a good idea. I mean, I think that there's so many and it's sort of like, what's the place to start? What are triggers that mean that you need to start here now or this can wait or how you can build out your business? Sure.

Well, let me just talk about the alphabet soup of the regulations and the enforcement agencies and then we can dive into to how you can deal with compliance, like at potentially as a competitive advantage for you as an innovator, right? So let's start with the laws. So there's a criminal statute called the anti-kickback statute. This is the example that I gave earlier where you cannot pay a kickback for a referral that is reimbursable by federal healthcare programs. So if you're a doctor, you can't pay someone for sending you a patient that's on Medicare or Medicaid. That's a no-no, right? And then there's a lot of safe harbors that they built into that, that statute that gets really complex to navigate. That's a criminal statute, but then there's also a civil statute called the Stark Law, and this applies specifically to physicians, and they cannot receive federal healthcare reimbursement for items or services, or they cannot receive things of value from the people that they have a financial relationship with, right? So I think it's, it's, and it's, it's very akin to the kickback statute, but I think the, the key thing here is that it's strict liability. The kickback statute, because it's a criminal statute, it requires intent. There's a lot of evidence there. The, the Stark Law, because it's strict liability, it's like a tripwire. If you receive payments and there's a financial relationship there and, and it's an improper one, you're already liable. There's the Eliminating Kickbacks in Recovery Act. That's very much like the kickback statute, but that specifically deals with recovery homes, treatment facilities, labs. There's the Food, Drug, and Cosmetic Act. This is where we deal with a lot of FDA approvals, right? You have a medical device, you gotta get it FDA approved. There's regulations about marketing on label, right? And then I think the biggest hammer, Dave, is gonna be the False Claims Act.

Now, what is that?

And I'm not sure if you're— I'm not familiar. Yes. So the false— yes, the False Claims Act, it's actually an old statute. It's— it goes back to the days of the Civil War. It was enacted in 1863. Sometimes it's called Lincoln's Law. It was really created initially to deal with people who were— there was these defense contractors that were supplying the Union Army during the Civil War with weapons that didn't work. And the government paid out. This is their way of preventing that. And what it did, the two big things that makes it one of the biggest enforcement tools in healthcare and life sciences. One, just the sheer amount of damages the government can get up to 3 times the amount that was paid out. So just like if you defraud the government $100,000, the government can go after you for $300,000. It's just really, really meant to deter defrauding the government. But then the second one that makes it so powerful is that there's this thing called a qui tam provision. And what that means, Dave, that, that, that's, it comes from an old, I think it's Latin phrase. Mm-hmm. You know, lawyers love their Latins. Qui tam, Q-U-I-T-A-M. And it really meant someone who sues on behalf of the king as well as for himself. It's really a whistleblower provision. Meant to say, hey, if you have information that someone is defrauding the government and you come forward, you can get anywhere from 10% to 30% of what the government actually got back. Now think about the financial incentives for that, Dave. When I was at OIG, I had a case. It was the largest grant fraud research misconduct settlement that HHS entered into. It was a $120 million settlement that the government got back from from the, the entity. So what happened or? It, it, it was research misconduct. It was a university that allegedly, there is no finding, there's no admission of guilt in that settlement, but they, they put out this falsified research that was actually cited in several studies in order to get federal grants. And the settlement amount for that under the False Claims Act ended up being around $120 million. And the whistleblower got pretty much 30%. So they walked away with like $33 million. Wow. And just for bringing this forward and pushing the government to pursue this, right? And so talk about financial incentive and talk about risk, right? Like not only are you dealing with landmines all over, but now you're looking over your shoulder because it could be people in your own organization who might want to profit off of your misteps, and for that reason, baking compliance into your whole business plan, your whole business structure, and as much as possible into their product itself, that will, that will save you so much, not only save you so much pain, so much stress financially as well from, from financial penalties, but it could ultimately become a competitive advantage.

So I'm going to take a tangent, then go forward, but it made me think of a story. I had a friend who was a federal prosecutor, and there was a dentist, and the dentist submitted a billing to the federal government for reimbursement, and he was overpaid. And then rather, they thought, oh, this is just a mistake, it'll never happen again. Then it kept happening, and then it turned out by the time they were caught, they had defrauded the federal government over a couple hundred thousand dollars in fees, and then he subsequently went to prison. And I don't know like how that works with everything in terms of an entrepreneur understanding their fees, understanding what to do if something like this happens, or just how it reflects compliance.

Yeah, so this goes back to, it was probably under the Stark Law or the anti-kickback statute, right? Because when you're dealing with physicians, you gotta worry about fair market value, right? Are you paying these people fair market value? Because again, it's counterintuitive to a lot of things in regular industry, right? Like you, in, in, in regular industry, you want to pay the best and the brightest, the most you possibly can to retain that talent. And it is true in healthcare and life sciences, but also if it looks like you're ultimately paying them for referrals, for customers, for patients, especially patients that are in Medicare or Medicaid, now you're looking at legal risk, not just financial risk, but also risk to your own freedoms. Like you said, it could be a criminal statute or it could be a criminal offense. And so you have anyone, you have agencies like the DOJ that can pursue you criminally or civilly, but then you also, you have agencies like my old, former agency, OIG, who can take administrative actions against you. And then on top of that, you also have state agencies with their own fraud and abuse laws and their own enforcement mechanisms as well. So, you're really, really going into a quagmire if you're stepping into the healthcare and life sciences space and if you're not familiar with that area at all.

So, looking at the, the business play, can you share stories, of course, without naming names, a company that leveraged compliance into their business as a competitive advantage?

Sure. Yeah, I, I won't say the names just because I, I think that there's a lot going on in terms of compliance and enforcement and things like that. But I think a good example, there's a company out there that's a global pharmaceutical company. There are, they are one of the top cancer therapeutic pharmaceutical companies, right? Cancer, terrible disease. I'm sure you've had people affected by it. I personally have had several family members impacted by cancer and friends impacted by cancer. And so, you know, it's something that these pharmaceutical companies are really, really trying to solve. And in '98, there was a pharmaceutical company that was the first to develop what's called a companion diagnostic for their pharmaceutical drug to treat cancer. And what this did was they not only created a ther— a drug to treat either the symptoms or treat cancer itself, but then they also created this tool. It's a diagnostic tool. It's a diagnostic test to help identify if you have this gene for cancer or if you have this cancer itself and it made you eligible or qualified you for this specific product. Think about the use case for that, right? Like now, not— you're not just reactive and providing a life-saving drug to people who know they have it. Now you're thinking about how do I help people identify that I might have this disease, even if you don't know it yet, right? And this becomes very important in like the rare disease space. Now we have these genetic tests that can help you identify if you are at risk of these rare genetic diseases. And when I say rare, we're talking about a single-digit percentage of the global population, right? And you think about that patient journey. And how frustrating it can be for those individuals who are struggling with, with this disease. A lot of times their physicians aren't even aware of that disease or aren't knowledgeable enough or specialized enough to identify, hey, you might have this one rare disease that only impacts 7% of the global population. So, imagine the stress of constantly having going back to the doctor saying, oh, I'm having these symptoms, these drugs aren't helping. It's because you've been misdiagnosed, right? And and how frustrating it is to hear from your doctor, I don't know what's wrong with you yet. Let's run more tests. Imagine if there was a test out there that could say, hey, actually this is what you have. And actually this aligns with, there's a drug out there that can help treat you. Now, in the rare disease context, in several diseases, in the context of several disease states, that's not only more convenient and helping with the pain and suffering, but it could be life-saving., right? So this was the first company to do it back in 1998. They got FDA approval for it and it became almost a companion test to their drug. And now there's a whole industry of genetic tests, companies sponsoring genetic testing programs so that they can help patients identify whether they're at risk early on. Because what do we always hear about healthcare, right? Prevention is so much better than treating the symptoms after you have it. So it was, it was revolutionary. You know, you think about it today, it's like, oh yeah, that does make sense. Like, why wouldn't you have companion tests to pair it up with a drug? But that was brand new at the time.

I mean, so is your role, or is a role of a, of counsel also to help people work their way through the approval process with these federal agencies so they can have a, their, their business or service or technology included as accepted technology for billing?

That's right. In, in the US, you know, in order to sell or, or market an item or a medical device or a drug that could treat symptoms, it has to be FDA approved. So there's a whole process for that. That's under, that's under the Food, Drug, and Cosmetic Act, right? And so you have to do, you know, sometimes it's clinical trials depending on, on what the, the, the item or service is. There's different regulatory steps you need to take. And it's not something, it's one, it's not cheap to go through. And then two, you know, there's a lot of administrative know-how. You gotta know who, which agency you're going to be submitting your applications to, what needs to be submitted, how to appeal. Bad decisions if, if you get a negative decision throughout this process. Um, so definitely this is where you need at least a consultant or, or a legal professional to help you guide the way.

How can entrepreneurs work with their legal advisors to make sure that compliance doesn't just slow them down, but actually positions them to, to be recognized a better opportunity for investors or in a better place in the market?

Sure. Now, yeah, I mean, I think the best way to think about it is opportunity cost, especially if you have a new and innovative idea, right? Think about that companion diagnostic. That was the first one in the market that got FDA approved, right? You can't just have a copycat spring up overnight and do that. They need to, one, figure out, wow, this is a great idea. How do they do that? But then two, they have to go through the whole process themselves of of getting FDA approved before it enters the market. So being a first entrant that's FDA approved in the market, that gives you a great competitive advantage. You really have no other competition in that space at that point, right? So I think that's the biggest thing. So think of the opportunity cost, but then also think about the, the flip side, the, the negative cost if not doing it, right? Your product doesn't get approved. That's probably the best case scenario. Worst case scenario, you're paying millions of dollars in fines, or potentially even going to jail and losing your freedom. So all the, the range of positives of engaging a, a legal professional to help you do that and guide you through this process versus the, the costs of not doing it. I think it, you know, if you put it in that context, it's an easy decision. But I get that it's difficult upfront when you're running on a tight budget and you need to prioritize how you do it. You know, compliance doesn't need to be expensive. It can be built into the DNA of your company, of your product, and it isn't a one-time thing either. It'll grow with you. It'll evolve with you. And I think, you know, that's where there's a thing called the 7 elements of compliance, of a compliance program that is widely accepted as a best practice. And a lot of federal agencies expect you to have it. In fact, OIG, if you run afoul of laws and you don't have a compliance program, sometimes they will actually make you enter into what's called a corporate integrity agreement where you're monitored by the agency for 5 years or so. And what they're monitoring is, are you actually implementing these 7 steps of a compliance program?

Is there— like, there's that line about how do you eat an elephant? You know, one bite at a time. So with this, consideration for compliance, are there 2 or 3 first bites that you'd recommend?

Sure. I mean, I think to set the stage, I think we need to talk about what the 7 elements are first, right? So the 7 elements of a compliance program that agencies expect you to have are, one, that you have a compliance function. That, you know, that's either a compliance officer or a compliance committee on your board of directors, somebody that's actually in charge of this. The second element are policies and procedures. You have standardized policies and procedures in place to ensure compliance across your company. Third, you have training and education. So what this means is you're socializing those policies and procedures across your whole organization and relevant individuals in there, right? Who needs to know about these policies and procedures, and how are you training them? Is it effective training? I think most of us have worked in companies where you have to do, you know, once a year, HR emails you and says, hey, you have to do this training to do, and you typically just leave it on in the background while some cartoon video plays. Is that effective training? Are you actually learning the policies and procedures then, right? Now think about if you're in a high-risk space like healthcare and life sciences and something that could get your company in trouble or potentially you in jail, right? Think about how do you make sure now that your staff is actually appropriately trained? On those risk areas. The fourth is auditing and monitoring. So you are doing regular audits of your risk areas, and you're, you're doing ongoing monitoring of those risk areas as it goes. There's a difference, right? Auditing is more of a retroactive look. Monitoring is ongoing and in the moment. It's like the difference between, like, looking at old records from the past year versus watching a security monitor. Right? Open lines of communication is the fifth element. So that the organization has an open line to report areas of non-compliance, whether that's directly to the compliance officer, but also that the compliance officer has a direct line to the C-suite. So a lot of times you'll see it's a best practice that the compliance officer is not part of legal. It doesn't report to legal, but it, instead, it reports directly to the either the chief executive officer, the president, or the board of directors, right? Because legal has certain interests in mind. HR has their own certain interests in mind. And you can imagine conflicting interests there between a compliance concern versus a legal decision that might have business implications for the company. Open lines of communication, that also includes a hotline. A lot of times you'll see, if you want to report something and remain anonymous, a hotline complaint. Like, that's a great tool, and that's almost like the gold standard, like expected now across these industries. And the last two are investigating issues of, or suspected areas of non-compliance, and then the last one is disciplinary or corrective actions when you actually find non-compliance. So a company, you got to be able to implement all those seven elements, right? Now, if you're going to talk about eating an elephant one bite at a time, You're not going to expect to have all of that on day one. Maybe you start with, okay, day one, who is going to be in charge of compliance? That's the first element, right? Like, designate somebody and, and who are they going to report to? And then you start building out your policies and procedures. And a lot of times, you know, that's a trial and error process. And it's also a best practice of any business, right? Like, you want to have good policies and procedures. I have my own law firm, and I think that's something I'm dealing with right now that I just launched. And like, how do you do this when a new client comes in? What's the policy for that? What's the procedure for that? So that anyone who steps into my shoes, or if I need to delegate that, they know exactly what to do and it's standardized. You know, that's how it should be for compliance. And it shouldn't be like a wishlist. It should actually be how are things actually going? Right? And then as you develop more and more, your training and education can get more sophisticated. Your auditing and monitoring can get more sophisticated, right? So it should grow with your business. You don't need— you're talking about sayings. You don't want to kill a fly with a cannonball. You don't want to overspend on compliance when it's not even a risk area for certain areas. So I think it's identify your risk.

And then have your compliance program grow with your company. Is there, are there any companies that come to mind that are recognized for their, their, their structure for compliance that other companies could look to as models?

You know, I think I, I, I, I, I'd be afraid to, to call out one company because you never know tomorrow. Right. You might hear 'em in the news. But I, I, I think the best examples honestly are companies that have gotten in trouble. And have gone through the corporate integrity agreement process and have succeeded in getting out of that monitorship, because that means now the OIG has looked at their compliance program and has found it sufficient enough and such that they no longer need monitoring, right? Because it's a, it's a process. They report those, they had to do annual reports, annual audits, and they had to report it to the OIG monitor. And then there's site visits sometimes. So it's pretty, it's a pretty thorough examination for 5 whole years. And then on the other side of it, whatever issue that got them into it, it should be well off, right? So I think it's, is sort of a, a counterintuitive example, but I think that that's at least been my experience when companies get out of a CIA, as we would call 'em a CIA, corporate integrity agreement. And yeah, those companies, they have A lot of them have effectively gone from no oversight, no compliance, to a pretty robust compliance program that is— changes pretty well. And, and you know what, Dave, it's really more so than— and I had this attitude when I was going through law school and learning about compliance. You hear about this and you think it's just like, oh, this is a checklist. 7 elements, policy procedures, check. Training education, check. It's not, it's really about culture. It's a culture of compliance. Because what I found, and in my experience, when I was a monitor at OIG, when we're implementing these compliance controls, it was really a people problem, right? You had people that either didn't care about compliance, that were greedy or incompetent or whatever it was, that just didn't care to put the effort into compliance, and that, that showed in the culture that they created.. And then as you're implementing this program and making it a requirement, those people naturally sort of weeded themselves out because they get put in the hotspot, they get put in the hot seat through these programs. They become identified much more quickly. The concerns get raised proactively as opposed to retroactively after the government comes knocking. And it really becomes a whole transformative culture. It's almost, I don't want to make it seem too kumbaya, but that's really what it is. It's really like a come-to-Jesus moment of who are we as a company, right?

I've had friends, and for a lot of different contexts, they'll talk about how— oh, there's an expression. I understood it to be Chinese in origin, but I could be wrong. But the idea is fish rots from the head. And that if the leadership has to embrace something for the organization to implement it and act on it, and if the leadership doesn't embrace it, then it's not going to be and act it.

Exactly, right? So, I mean, and I think this is really what it is. It's not a checklist, and it's just in the same way that if you're an innovator, if you're an entrepreneur, if you have this big idea, you want that mission. You know, there's a guy out there, Simon Sinek, he did that TED Talk, you know, Start with the Why. And like, that's what makes successful companies successful. Like, he talked about Steve Jobs and Apple. You know, they start with the why, We, we want to create products that transform people's lives. And by the way, we just happen to make computers. Like, and a lot of entrepreneurs I know, that's sort of their why. They want to transform the delivery of healthcare, but we just happen to have this medical device that does it, or we just happen to make this drug that does it in this sector. But the why is that pull-through, and then incorporated in that should be a, a, a, a thought about compliance, right? Because you're not, if that should be a natural extension of your why, right? If you're— if your why is to save lives, transform the delivery of healthcare in the United States, the compliance is how you do that. And if you're being greedy about it, you're not saving lives anymore. If you're being nefarious in your business practices, that's not— that's inconsistent with that why, right? So I think that's what it means to build it into the DNA. And these 7 elements, these enforcement actions, all this is really just like symptoms of, like you said, like the fish rots from the head. And so, uh, it, it, it really comes down to culture. It really comes down to values, and it really comes down to how those values manifest.

How do investors and VCs evaluate compliance readiness during their due diligence process?

So I think a lot of times it becomes an afterthought, and this is where a lot of people can get into trouble. And this is where a lot of deals can fall apart, right? Because I had someone come to me the other day and they were talking about there's this physician practice that wants to buy another physician practice and they're in early talks, but they had no idea about, you know, regulatory compliance, right? Like you're a healthcare practice and yes, you're doing the deal. You want to talk about deal sheets, term sheets, you know, interest rates, things like that., but then like compliance became sort of an afterthought. It's like, oh wait, now they're looking to, to hire me and I'm gonna come in and, and gonna ask, okay, well let's talk about it. Do you have policy, policies and procedures? Do you have, you know, so I think it's a lot of times it becomes an afterthought and it can actually be a, a big hangup in deals because that became something that holds, either holds up a deal that wasn't built into the timeline, the compliance review. But also a lot of times that compliance review can reveal real legal risks and financial risks that really ruin the whole deal. I've had cases where that happened before.

We were, you know, it's sort of like taking this sort of the flip side. So what's the fastest way for a startup to lose investor trust?

You may be just speaking to that. Exactly. So I mean, I think the fastest way to lose investor trust is it's sort of like getting exposed for not having this on the forefront, right? You talk a big game, we're the best in XYZ, and someone says, okay, well, let's see your policies and procedures, or let's see your hotline complaint log. And then you're like, oh, what do you mean? That's a big red flag that there is no compliance program, and it could set off, okay, what other alarm bells are there? What other financial arrangements have you potentially entered into that if we invest, we're going to be on the hook for paying out civil monetary penalties, right? If, if you're, if you're not serious about compliance, that could really, really impact your marketability to VCs and investors.

And can it increase valuation of a company or decrease it depending on what track they take?

Potentially. I mean, I don't know if it necessarily would increase, but you could imagine it would decrease, right? So a lot of times what we do, a lot of publicly traded companies, for example, have to report instances of litigation or government enforcement. That's like an SEC regulation, right? And a lot of companies will have to make reports to their investors, make SEC reports that, hey, we just received a subpoena from the FBI because they're looking into this anti-kickback statute allegation. Imagine what that does for investor confidence. Imagine what that might do to your stock price once that's revealed. Right? So the same thing is true in, in the smaller context, right? Like you have investors coming in, they will ask, do you have any known or threatened areas of litigation or enforcement? And you have to answer truthfully. Otherwise, you know, you could, the deal could get blown up. Investors could come back after the fact and sue you. But, you know, and, and that's going to be an area that should come up as part of the compliance due diligence.

Excuse me, how is AI changing the compliance landscape in healthcare and regulated industries?

I think it is— AI is a great example of what it means for an innovator or a disruptor to enter the healthcare and life sciences field, right? Because especially if you're coming up with something brand new, you're dealing with laws that have been in place. Like I said, the False Claims Act has been in place since the Civil War. And a lot of regulations have been in place in the '90s, '80s, '70s before a lot of technology and business models that we have today were put into place. So you're trying to commercialize a product for the new era within a regulatory scheme that's antiquated, maybe going all the way back to the '90s, 1960s. And so how do you, how do you marry that? How do you reconcile that? And a lot of times it's, you don't know, and you're just making the best educated guess and hoping that you got it right. You know, now AI is an example of this. You know, HHS is putting out, there's no consolidated framework just yet. They're putting out, you know, guidelines for how their own agencies should use AI, but AI just the free— the how quickly it's being implemented and how quickly it's being adopted just by the general public, it creates a whole lot of risks, right? Because in AI, you have a program that is being trained. Now think about this in a healthcare context, especially with HIPAA. How are you training this program? What patient data is being used to train it? If patient data is, is, is going to be input into this system, what controls are there to protect it under this HIPAA statute? AI wasn't around when HIPAA was first written, you know? And so these are things that that's going to have to be reconciled and thought through.

Because you have to anonymize HIPAA-related data as you build things?

Is that how people— It depends on the context, right? Like, depends on who you are in that context. Are you delivering healthcare? Do you have a business associate agreement in place, how are you getting the PHI or the PII?

And so all of those things, like, it becomes very, very context-specific. So as you're looking at regulators, are they moving faster or slower than technology? And what does that mean for startups?

They are— it's definitely slower. They're not ahead of the curve. They're, if anything, they're catching up to where we were 5, 10 years ago, because you think about, think about, and not to get political, but think about Congress today. Think about what it takes to pass a law. Think about what it takes for a new regulation to get drafted under the Administrative Procedures Act. Even if you're not, even if there's a law already in place and you're just creating a new regulation, there has to be a notice of proposed rulemaking. There needs to be a certain comment period where the public can comment on it. And then there needs to be a final rule that's written that addresses all of those comments. And then if any of those steps are, are not done correctly, that whole regulatory scheme could get thrown out the window as a violation of the Administrative Procedure Act, right? Bureaucracy. And so it's always gonna be behind the curve. And there's, you know, there's ways to sort of walk around it. For instance, the OIG has a process called an advisory opinion that you can reach out to them and say, hey, you know, there's this risk area that my product or this financial arrangement that I've entered into implicates. This is what I'm certifying to be true about the context of the situation. Based on these facts, is this something that would be allowed, or is this something that you would enforce a law against? And then OIG opinion puts out a guidance, uh, and, and they put out a certain number every year, and that actually becomes a good guiding post for a lot of people in the industry to understand, okay, this is what the OIG thinks to be too high risk to where they would take enforcement action. And then this is where they said that they won't take any enforcement action, even though it might implicate the statute because OIG has enforcement discretion. Now, there is a, there's a caveat there that that advisory opinion only applies to the person who requested it. It can't be relied on by other parties and things like that. But it's still a good, it's like a, you know, it's, it's like sticking your finger in the wind to get to get an idea of which way the wind is blowing.

And, and so there's different tools and, and guideposts like that out there. Is there an, is there a consideration for time associated with compliance and regulatory structures that, that entrepreneurs should understand?

Like, I, I don't imagine any of this happens fast. Definitely not. And so, I mean, I, I think that's where I said, like, it's so important to think about it as it needs to grow with your company, right? And day one, if you're building something out of your garage, it is just you. So maybe it's just you that talks to an attorney or a consultant and, and just to get an idea of, hey, I have this product, what, laws does this implicate? What do I need to think about? Because if you have that in the front of your mind as you're building your product, it's going to be so much more beneficial and easier than if you already had a product or a service or a software and you found that, wait, there's no way to effectively commercialize this without violating HIPAA. There's no way to effectively commercialize this, you know, that doesn't run afoul of, of certain laws. I think that just knowing, getting it, it's like if you wouldn't go on a road trip or you wouldn't go on vacation to a new area without scoping the landmarks out, right? I mean, I guess you could if you want to be adventurous, but when the risk is potential loss of your freedom, then yeah, you would probably scope out Hey, like, what places should I visit? You know, what places should I avoid? Where should I be more careful? And that's the same exact way with, with regulatory compliance and building your company. And now, as it gets more sophisticated, you have more actors under you, then you have a more sophisticated compliance program. Maybe you have a compliance officer at that point who reports to you and that people can go to, to raise their concerns or just ask questions. And so, it's not a one-size-fits-all, it should really be tailored to your industry, your product, and those specific risks associated with it.

What should founders know about scaling into global markets with different regulatory requirements and regimes and procedures?

Sure. I mean, think about the US, right? And I think AI was a good example because there is no national law regulating AI just yet. Even in healthcare, life sciences. But I think, um, there's different states have different laws around AI already, right? It's a patchwork system, and that's just alone in the United States. Now imagine this on a global context. Imagine if you have a new drug or a new medical device and you get FDA approval. And because when you, when you seek FDA approval, you don't always get it for everything that you ask for. You know, because it needs to be supported by clinical data. The FDA looks at the clinical data and, and verifies it and says, actually, yeah, based on the evidence that you gave, we think that we could say that this product treats brain cancer and skin cancer, right? Just as an example, let's say you, that's what you want. And then the FDA will look at it and they might say, yeah, actually it does treat both., and you can market it as such. Now you go to Europe, they may look at the same data because we know that science is always gonna be peer-reviewed and, and, and, and, and there's always gonna be different conflicting— that's, that's just the nature of science, right? And the consensus in Europe might be actually this product only has sufficient evidence to support an indication for brain cancer, not skin cancer. So now you are talking about the same product that's been approved for two different things, and now you're gonna talk about marketing it and bringing it to market. You can, you now you're gonna have to have a set of marketing materials just for the US versus marketing materials in the, in the EU. And then think about all the different countries that you gotta do that for, right? That's just like a, a minor little example. Same thing with the kickback statute, right? Or, or even like marketing practices. Certain countries will not let you market medicine, pharmaceuticals directly to customers. In the US it's allowed. That's why we have all these commercials on TV where the announcer speaks really, really fast, talk about the side effects and all those things. You won't see that in, in some countries, especially in Europe, right? Because that's not allowed. And because that has to do with the different philosophy of what the role of the physician is. You know, in the US it's very much more patient-centric. In certain countries, it's much more the healthcare provider is really the gatekeeper because they have specialized knowledge to do that. So only the doctors can get marketed to and they can talk about that, you know, so there's different channels, there's different avenues in, in the way that it's done and You gotta worry about being compliant with all of it. You gotta track it. You gotta implement a system that makes sure your practices are compliant with all of those. And then you gotta have a compliance program that's tailored to each and every jurisdiction, right?

So it can get quite complicated. What does it mean to bake compliance in from day one? Are there simple processes that won't slow down innovation? And then getting a lawyer.

I mean, that's a big scary thing for a lot of companies. Right. I think baking compliance in from day one means understanding your risk area first and foremost. You have this big idea. What is it implicating? You know, and I think, and you want to talk about being scary and getting a lawyer is being scary. What's scarier to me is walking into a dark room with a bunch of sharp objects. Right? And yeah, a cost of a flashlight might put me out a few bucks, but it's going to save me the ER bill later on if I walk in there without it, right? That's how I view a lawyer in this instance. That's how I view a consultant in this instance. It's, it's, you are getting, you're coming in wide-eyed, right? And that alone not only keeps you out of trouble, but done correctly, it can give you a competitive advantage. Just like I said in the example earlier with the FDA approval for, for the companion diagnostic, if you're so cutting edge that you're the first one to market, that's gonna one, put you way ahead of the competition because there won't be competition. And two, that gives you so much more credibility now as a new entrant in this space. How should people think about how to identify and find a lawyer that's appropriate for their needs or their industry or their business? In the same way that you as an innovator, as an entrepreneur, want to establish credibility, think about the same ways that— look for the same things in your attorney, right? So what experience do they have? What credentials do they have? And ask the questions, right? Like, you want to talk about your budget. First and foremost, a lot of people like talking about money and they can just say like, I don't want to spend any money or I have no money. Like, that's not a helpful conversation. You can say, look, realistically, this is my budget that I have and I want to do XYZ. What can you do for me there? Right? Some attorneys charge on billable hours, others do flat fees. Now you can also ask about their experience, like what? What other past clients have you worked with? What are your success stories? What agencies have you interacted with? Because just because like someone's a healthcare and life sciences attorney or a compliance person, that doesn't mean that they know it at all, right? You could have someone who's very niche on just FDA approvals. That's a whole subset of the market in the legal industry, like just getting your products FDA approved. Those people may not necessarily have the same expertise as someone coming in and helping you now get your product eligible for federal healthcare reimbursement, right? And so that's going to be different versus having someone come in and talk about how do you draft a contract with a physician so that it doesn't implicate the anti-kickback statute or the Stark Law. So those are all different skill sets, and it may not be the same attorney that you got to you gotta think about what your risk profile looks like first and foremost, and then build your, your team of Avengers, right, around that, addressing those specific risks.

So it may, at the, at the end of the day, it may not be a single lawyer.

It just depends on your business. That's right. Yeah. And you may have like a general counsel who sort of manages this for you because that's often why you have companies that have in-house counsel, right? They, they manage all these risks, these legal risks, risks, and then they'll engage outside counsel as needed for project-specific needs, right? We have this new product, we're at a stage where we need FDA approval, so we need someone to do that versus we're super early, we don't even have a product yet, we just need an investor. So what does a contract look like? So, right?

So that's going to be completely different skills. So in a sense, are you saying that the counsel that a company should look for, you're looking for a shepherd, you're looking for a toolkit as opposed to just saw or a hammer?

I like to think of it as, I mean, I like the shepherd example. I personally like to think of it as you want a tailor. You want a tailor who will take your measurements, see what looks best for you, see what you need. How do you move? Right? One of my best friends is a tailor, and this is why the example comes to my mind. He was actually, he did my suit for my wedding, right? And I told him what I needed. And what I wanted to look like. And he handmade my whole wedding outfit. And the same thing with good legal counsel. They'll look at your profile, at your risk profile, and then they'll build a team around you that'll say, this is what will enable you to do what you want to do and to make you do it the best way you can do it.

So, and is this what you mean by a bespoke counsel or bespoke service.

That's right. Yeah. At my law firm, we, our big thing is bespoke legal advocacy, right? And just in the same way that a suit should flow with you and not against you, right? Like, think about this. Now, this is the fashion head in me, right? You can tell the difference between a well-fitting suit and a terrible fitting suit. And the best fitting suits are those that flow with the body, that that, that look smooth with the body and aren't tight or aren't pulling against or restricting movement. And the same thing with good legal counsel. It shouldn't restrict your innovation. It shouldn't restrict your movement so much to where it inhibits you, but it should actually flow with you and empower you to do what you want to do the best way possible.

That's great. Let's like to go to the last part of our discussion where we talk about the launch code. So based on our conversation, what are the top 3 things that you want innovators in healthcare and life sciences to take away from this conversation?

Yeah, so I think the 3 things— bake it into your DNA. Think about your, your risk profile just as much as you're thinking about your product that you're building or your company that you're building or the service that you're building. Because the more holistic a picture you have, the more successful you can be down the road. So bake it into your DNA as much as possible. The second thing, and this is sort of the flip side of it, think about the cost of non-compliance. Like I said, it's scary to pay out certain much for a lawyer. It's scarier to me to walk into a dark room with sharp objects all around. That's, that's the risk of non-compliance, right? Your product not getting approved or going to market, you having to pay financial penalties and possibly even going to jail, right? Like those are, there's a whole range of risks there. And then lastly, think about compliance not as something that you need to do or a checklist, but really if it's done really, really well, it could be a key, a factor in giving you competitive advantage, right? It's a way to maximize value as opposed to inhibit it. So compliance done well and with good counsel, with good consultants and growing with you, evolving with you, it really, really can be a competitive advantage. It can attract more investors. It can keep you out of trouble. In fact, it could at several times, it could clear the competition, right? So I think those are the 3 things. Bake it into your DNA, think about the cost of non-compliance, and then use it as a competitive advantage.

Dennis, that's great.

Thank you so much for this helpful conversation for entrepreneurs. Of course. Yeah, it was— it's been great, and I'm excited to be doing this with you. You know, I'm really excited to have other guests that we'll be talking to about this in the industry.

And I think it should be really, really interesting. And that's it for this first episode of Ready for Launch. A big thanks to Dennis for breaking down what makes startups in healthcare and life sciences so unique. If you found today's conversation valuable, please follow the show on your favorite podcast platform, leave us a rating, and share it with a founder or business leader who could benefit. If you're interested in sponsoring contact Dave or Dennis from the details in the episode show notes. The show notes will contain the references that Dennis discussed in today's episode. And thanks for listening, and we look forward to talking again soon.