DOJ Targets Failure to Report Adverse Events: Lessons From the ExThera Enforcement Action

In March 2026, the US Department of Justice (DOJ) announced criminal charges against medical device company ExThera Medical Corporation and its former chief regulatory officer for allegedly concealing patient deaths associated with the company’s experimental blood filtration device. The case highlights a familiar, but often underappreciated, risk area for life sciences companies – the obligation to report adverse events to the US Food and Drug Administration (FDA).

The enforcement action underscores two themes that regulators have emphasized for years but that continue to surface in enforcement matters. First, regulators view accurate and timely adverse event reporting as a critical obligation. Second, individuals responsible for regulatory compliance may face personal criminal exposure when reporting obligations are ignored.

For companies operating in the life sciences sector, the case serves as a reminder that adverse event reporting is not merely a regulatory formality – it remains an enforcement priority.

The ExThera case

According to DOJ filings, ExThera developed a blood filtration device designed to remove pathogens from patients’ blood. The device had not received FDA marketing authorization for any medical condition in the United States, although it received emergency use authorization for certain COVID-19 uses, and ExThera obtained Investigational Device Exemptions allowing for certain limited clinical study uses, including treating sepsis and a certain form of pancreatic cancer.[1]

In 2024, two US cancer patients traveled to a clinic in Antigua to receive treatment using the device. During the course of treatment, the patients’ conditions deteriorated, and both later died.

Federal prosecutors alleged that ExThera’s chief regulatory officer learned of the patients’ declining health and deaths but intentionally failed to report those adverse events to FDA. According to the government, the executive concealed this information in order to protect a $10 million commercial deal related to the device and avoid triggering regulatory scrutiny that could jeopardize the company’s financial prospects.

The enforcement outcome included both corporate and individual resolutions:

• Individual liability: The executive pleaded guilty to a criminal charge for failure to report adverse events and faces a maximum sentence of three years in prison, along with forfeiture of compensation received during the relevant period.
• Corporate resolution: ExThera entered into a three-year deferred prosecution agreement and agreed to forfeit approximately $5.7 million in profits, along with a reduced criminal penalty of $750,000 due in part to concerns about the company’s financial viability.

Although cases are always fact-specific, the theory of liability here is familiar: Failing to comply with regulatory obligations, including reporting safety events to FDA, can have serious consequences for both individuals and companies.

FDA adverse event reporting obligations

The law requires the reporting of certain adverse events for a number of FDA-regulated products, including drugs, biologics, medical devices, cosmetics and dietary supplements. These reporting regimes are central to FDA’s post-market surveillance system, which allows regulators to identify emerging safety risks. Failure to comply with adverse event reporting requirements is a violation of the FDCA and can result in civil and criminal penalties for both companies and individuals.[2]

Enforcement focus: When reporting failures become criminal

DOJ and FDA have long enforced the adverse event reporting requirement. In practice, adverse event reporting violations are often addressed through FDA warning letters or other civil compliance and administrative actions. For example, since 2021, FDA has issued at least a dozen warning letters to companies for failure to submit adverse events. The majority of the warning letters related to devices; however, FDA also issued warning letters to drug and dietary supplement companies.[3]

Enforcement against products, individuals or companies regulated by FDA can escalate, however, especially where there has been significant patient harm or an intent shown on the part of the company or individuals to evade FDA regulation or defraud or mislead consumers.[4] The government’s allegations in ExThera fit squarely within that framework, focusing not merely on a reporting lapse but on an alleged decision to withhold critical safety information from regulators following two patient deaths in a clinical trial.

ExThera is not the only case with this familiar fact pattern that resulted in a criminal resolution. In 2024, medical device manufacturer Magellan Diagnostics pleaded guilty to concealing a malfunction in its blood-lead testing devices and failing to submit required reports to FDA after learning of the issue. According to DOJ, the company was aware that its devices were producing inaccurately low lead test results – which could mask dangerous lead exposure in patients – but failed to timely report the malfunction to regulators. Instead, according to DOJ, the company hid the malfunction, continued distributing the devices and delayed disclosure for months.[5]

Beyond ExThera and Magellan, since 2011, FDA and DOJ have pursued at least six other criminal cases against both companies and individuals for failing to report adverse events.[6] These cases illustrate an important distinction regulators often draw: While some reporting failures may be addressed through civil compliance and enforcement actions, when companies and individuals fail to comply with regulatory requirements to avoid FDA scrutiny – particularly where patient harm is involved – they are more likely to give rise to criminal liability. 

Continued focus on individual liability

Another notable feature of the ExThera case is DOJ’s continued emphasis on individual accountability. Of course, prioritizing the prosecution of responsible individuals is an evergreen mandate for DOJ, and this has been reinforced through multiple policy statements and guidance documents across administrations.[7]

The government’s decision to charge ExThera’s chief regulatory officer, however, does represent a shift from focusing only on the most senior corporate officials, such as CEOs, who are sometimes prosecuted under the Responsible Corporate Office Doctrine, to those who are directly responsible for the conduct at issue. The ExThera case demonstrates that employees responsible for regulatory submissions – particularly those working in regulatory affairs, pharmacovigilance or safety monitoring – may face personal exposure if the government concludes that safety information is not reported.

The ExThera case is a reminder that DOJ enforcement in this area remains a priority. Companies operating in industries regulated by FDA should ensure their compliance programs include regular training on adverse event reporting requirements and have clear lines of accountability, particularly as companies are now expected to comply with FDA’s revised Good Manufacturing Practice requirements – known as the Quality Management System Regulation (QMSR) – which took effect in February 2026.[8]

---

[1] Press Release, US Department of Justice, Former ExThera Medical Corporation Executive Admits to Concealing Patient Deaths from FDA and Company Enters Deferred Prosecution Agreement, March 5, 2026.

[2] See 21 U.S.C. § 331(ccc)(3) and 21 U.S.C. § 333.

[3] See, e.g.,Warning Letter, US Food and Drug Administration, Apothecary Health Solutions, September 20, 2021; Warning Letter, US Food and Drug Administration, Central Admixture Pharmacy Services, Inc., July 10, 2024; Warning Letter, US Food and Drug Administration, M.O.M. Enterprises, LLC, April 22, 2025; Warning Letter, US Food and Drug Administration, Diasol, Inc., January 29, 2026; Warning Letter, US Food and Drug Administration, Avertix Medical, Inc., September 3, 2025.

[4] The Federal Food, Drug, and Cosmetic Act (FDCA) is a strict liability statute and proof of knowledge or intent is not required for misdemeanors. Note, however, the May 2025 executive order from President Donald Trump stating that strict liability regulatory offenses are generally disfavored. See Executive Order No. 14294, 90 Fed. Reg. 20363, May 9, 2025.

[5] Press Release, US Department of Justice, Magellan Diagnostics Agrees to Plead Guilty and Pay $42 Million to Resolve Criminal Charges, May 21, 2024.

[6] See, e.g., Press Release, US Department of Justice, GlaxoSmithKline to Plead Guilty and Pay $3 Billion to Resolve Fraud Allegations and Failure to Report Safety Data, July 2, 2012; Press Release, US Department of Justice, Pentax Medical Company Agrees to Pay $43 Million to Resolve Criminal Investigation Concerning Misbranded Endoscopes, April 7, 2020; Press Release, US Department of Justice, New Jersey Medical Device Manufacturer Admits Selling Contaminated Ultrasound Gel; Court Orders Permanent Injunction, July 6, 2016.

[7] See, e.g.,Press Release, US Department of Justice, Corporate Enforcement and Voluntary Self-Disclosure Policy, March 10, 2026; US Department of Justice, Justice Manual § 9-28.210; US Department of Justice, Individual Accountability Policy, September 9, 2015.

[8] See 21 C.F.R. Part 820. The QMSR is intended to align US medical device quality requirements with international standards.