Deferred Prosecution Agreement, dated September 22, 2017

Exhibit 10.4

UNITED STATES DISTRICT COURT

DISTRICT OF MASSACHUSETTS

DEFERRED PROSECUTION AGREEMENT

1.                                      William D. Weinreb, Acting United States Attorney for the District of Massachusetts (by Assistant U.S. Attorneys Young Paik and Kriss Basil) (the “Office”); the United States Department of Justice, Consumer Protection Branch (by Trial Attorney Shannon L. Pedersen); and defendant Aegerion Pharmaceuticals, Inc. (“Aegerion”) (by defense counsel Joshua S. Levy, Esq., Ropes & Gray LLP and Aegerion’s current Board Chair, Mary T. Szela, pursuant to authority granted by Aegerion’s Board of Directors), hereby enter into the following Deferred Prosecution Agreement (“Agreement”).

2.                                      Aegerion consents to the filing, in United States District Court for the District of Massachusetts, of an information charging Aegerion with conspiring to violate the patient privacy provisions of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). This Information (hereinafter, “the HIPAA Information”) charges a violation of Title 18, United States Code, Section 371, to wit: conspiracy to violate Title 42, United States Code, Sections 1320d-6(a) and 6(b)(3), using or causing to be used unique health identifiers, obtaining individually identifiable health information relating to individuals, and disclosing individually identifiable health information to another person, with the intent to sell, transfer, or use individually identifiable health information for commercial advantage, personal gain, or

1

malicious harm. Aegerion knowingly waives its right to indictment on this charge and agrees to venue of the case in the District of Massachusetts. Aegerion further waives any legal or procedural defects in the Information.

3.                                      This Agreement is effective for a period beginning on the date on which the HIPAA Information is filed (“Effective Date”) and ending thirty-six (36) months from that date (the “Term”). However, the United States Attorney’s Office for the District of Massachusetts and the Consumer Protection Branch of the United States Department of Justice (jointly, the “Government”) agree that, in their sole discretion, the Term of this Agreement may be shortened by no more than twelve (12) months. However, Aegerion agrees that, in the event that the Government determines, in its sole discretion, that Aegerion has knowingly and materially violated any provision of this Agreement, an extension of the Term of the Agreement may be imposed by the Government, in its sole discretion, for up to a total additional time period of one year, without prejudice to the Government’s right to proceed as provided in Paragraphs 14 to 19 below. Any extension of the Agreement extends all terms of this Agreement.

4.                                      The Government enters into this Agreement based upon the individual facts and circumstances of this case, including:

a.                                      Aegerion’s acknowledgement of its conduct and acceptance of responsibility for that conduct;

b.                                      Aegerion’s cooperation in the investigation of this matter and Aegerion’s commitment to continue cooperation with the Government’s investigation of violations of federal health care laws, securities laws, and other criminal statutes, by individuals associated with Aegerion;

c.                                       Aegerion’s commitment to enhanced compliance measures;

2

d.                                      Remedial measures undertaken by Aegerion and Aegerion’s commitment to undertake additional remediation as identified herein;

e.                                       Aegerion’s guilty plea to two misdemeanor violations of the Food, Drug, and Cosmetic Act (“FDCA”), Title 21, United States Code, Sections 331, 333, 352(f) and 352(y), as charged in an information (“FDCA Information”) filed by the Government in this matter, and payment of $7,200,000 in criminal fines and forfeiture;

f.                                        Aegerion’s entry into a Civil Settlement Agreement with the Office and the United States Department of Justice’s Civil Division, Fraud Section, to settle certain civil claims related, but not identical to the conduct that is the subject of the FDCA Information and the payment by Aegerion of $28,800,000, plus interest, to resolve those claims;

g.                                       Aegerion’s entry into a corporate integrity agreement with the United States Department of Health and Human Services, Office of Inspector General (“HHS-OIG”), in connection with the same conduct that is the subject of the FDCA Information, to implement certain specified compliance measures, which are related to those compliance measures specified in Attachment B of this Agreement;

h.                                      Aegerion’s entry into a civil consent decree, to be monitored by the United States Food and Drug Administration (“FDA”), in connection with the same conduct that is the subject of the FDCA Information;

i.                                          Aegerion’s commitment to full compliance with the FDCA and HIPAA; and

3

j.                                         Aegerion’s commitment to fulfill all of the terms of this Agreement.

5.                                      The Government will recommend to the Court that prosecution of Aegerion on the HIPAA Information be deferred for the duration of the Term of this Agreement. Aegerion waives its right to a speedy trial pursuant to the Sixth Amendment to the United States Constitution, Title 18, United States Code, Section 3161, and Federal Criminal Procedure 48(b), and Aegerion and the Government agree that, under 18 U.S.C. § 3161(h)(2), the period of delay during which prosecution is deferred is excluded from the time within which trial of the offense charged must commence. If the Court declines to defer prosecution or exclude the deferral Term from the time within which trial on the HIPAA Information must be commenced, this Agreement shall be null and void, except for the tolling provisions described below in Paragraph 14.

AEGERION’S OBLIGATIONS

6.                                      Aegerion admits that it is responsible for the acts of its employees, directors, officers, and agents, as set forth in the Statement of Facts, attached hereto as Attachment A (“DPA Statement of Facts”). Aegerion further admits that the DPA Statement of Facts is true and accurate and agrees that, should the prosecution deferred pursuant to this Agreement be initiated, Aegerion will neither contest the admissibility of the DPA Statement of Facts nor contradict the DPA Statement of Facts in any such proceeding, including any trial, guilty plea or sentencing proceeding.

7.                                      Aegerion shall not, through its present or future attorneys, Board of Directors, officers, employees, agents, or any other person authorized to speak for Aegerion, make any public statement, in litigation or otherwise, contradicting in whole or in part the acceptance of responsibility by Aegerion set forth above or any fact contained in the DPA Statement of Facts, subject to the following provisions:

4

a.                                      The Government shall have the sole discretion to decide whether any public statement contradicting a fact contained in the DPA Statement of Facts will be imputed to Aegerion.

b.                                      If the Government determines that Aegerion has made a public statement contradicting its acceptance of responsibility or any fact contained in the DPA Statement of Facts, the Government shall so notify Aegerion. Thereafter, Aegerion may avoid a breach by publicly repudiating the statement within five days after such notification. Any such contradictory public statement, if not repudiated by Aegerion, will constitute a breach of this Agreement as governed by Paragraphs 14 and 19 of this Agreement, and Aegerion thereafter will be subject to prosecution pursuant to the terms of this Agreement.

c.                                       This Paragraph does not apply to any statement made by any present or former officer, director, employee, or agent of Aegerion in the course of any criminal, regulatory, or civil case initiated against such individual, unless such individual is speaking on behalf of Aegerion.

d.                                      Aegerion shall be permitted to raise defenses and to assert affirmative claims in civil, regulatory, and other proceedings related to the matters set forth in the DPA Statement of Facts provided that such defenses and claims do not contradict, in whole or in part, a statement contained in the DPA Statement of Facts.

8.                                      Aegerion will comply in a timely manner with all of the terms of this Agreement.

If Aegerion sells, merges, or transfers all or substantially all of its business operations as they

5

exist as of the date of this Agreement (whether structured as a sale, asset sale, merger, or transfer), unless otherwise agreed to in writing by the Government, Aegerion will maintain its existence and its ability to fulfill and complete all of its obligations under this Agreement, or include in any contract for sale, merger, or transfer a provision binding the purchaser, or any successor in interest to Aegerion, to fulfill and complete all of Aegerion’s obligations under this Agreement.

9.                                      Aegerion agrees to provide complete, truthful cooperation with the Government and any other agency designated by the Government in any investigation or prosecution of Aegerion and/or any of its current or former directors, officers, employees, agents, consultants, contractors, subcontractors, and subsidiaries, or any other party, concerning the conduct covered by the HIPAA Information or the FDCA Information and any related plea agreement as well as conduct related to matters covered by the subpoena issued by the United States Attorney’s Office for the District of Massachusetts in November 2013, until the date upon which all investigations and prosecutions arising out of such conduct are concluded, whether or not those investigations and prosecutions are concluded within the Term of this Agreement, as follows:

a.                                      Aegerion will truthfully disclose all factual information that is not protected by any applicable privilege or protection with respect to its activities or those of any of its current, former, or future directors, officers, employees, agents, consultants, contractors, subcontractors, and subsidiaries, or any others, including any evidence or allegations and internal or external investigations, concerning all matters about which Aegerion has any knowledge or about which the Government or other law enforcement agencies designated by the Government, may inquire.

6

b.                                      Aegerion will provide documents, records, and/or other tangible evidence not protected by any applicable privilege or protection regarding matters about which the Government may inquire and identify knowledgeable directors, officers, employees, agents, and/or representatives to provide information, materials, and testimony. Aegerion will maintain and expeditiously produce any non-privileged documents, records, and/or other tangible evidence responsive to the subpoena issued by the United States Attorney’s Office for the District of Massachusetts in November 2013. Documents subject to production include documents in the custody, possession, and control of the pharmacy associated with the Juxtapid REMS program during the relevant time period.

c.                                       Aegerion will use its best efforts to ensure that its directors, officers, employees, agents, and representatives testify truthfully before the grand jury and/or at any trial or other proceeding with respect to any matters about which they may be questioned provided that the testimony sought is not protected by any applicable privilege or protection. Aegerion (and its directors, officers, employees, agents, and representatives) will at all times give complete, truthful, and accurate information and testimony provided that the information and testimony sought is not protected by any applicable privilege or protection, including the attorney-client privilege and the Fifth Amendment. Aegerion (and its directors, officers, employees, agents, and representatives) will neither attempt to protect any

7

person who has been involved in criminal activity, nor falsely implicate anyone in criminal activity.

d.                                      With respect to any information, testimony, documents, records, or other tangible evidence provided to the Government pursuant to this Agreement, Aegerion consents to any and all disclosures, subject to applicable law and regulations, to other governmental authorities of such materials that the Government, in its sole discretion, shall deem appropriate.

10.                               Within thirty (30) days of the Effective Date of this Agreement, Aegerion will (a) make this executed Agreement and its attachments, including the DPA Statement of Facts, conspicuously available to the public on its website for the duration of this Agreement; and (b) communicate to all Aegerion employees that Aegerion has entered into this Agreement and make available this Agreement and its attachments to all such employees.

11.                               Aegerion will implement and maintain internal controls, policies, and procedures designed to prevent and detect violations of HIPAA, including at a minimum, the elements set forth in Attachment B, which is incorporated by reference into this Agreement.

GOVERNMENT’S OBLIGATIONS AND RIGHTS

12.                               If Aegerion fully complies with all of its obligations under this Agreement, the Government will not continue the criminal prosecution against Aegerion described in Paragraph 2 and as described in the DPA Statement of Facts. Within thirty (30) days after the expiration of the Term of this Agreement, the Government will seek dismissal with prejudice of the HIPAA Information filed against Aegerion, and agrees not to file charges in the future against Aegerion relating to the conduct described in the HIPAA Information and the DPA Statement of Facts.

8

13.                               The Government will not use, in any criminal or civil case, any self-incriminating information provided by Aegerion pursuant to its cooperation that was not previously known to the United States, or any information directly or indirectly derived therefrom, except in (i) a prosecution or other proceeding for perjury, making a false statement, or obstruction of justice; (ii) a prosecution or other proceeding for any act of violence or act of terrorism; (iii) a prosecution or other proceeding relating to any violation of the Internal Revenue Code; or (iv) any prosecution or other proceeding permitted herein as a result of failure by Aegerion to comply with the terms of this Agreement.

14.                               If, during the Term of this Agreement, Aegerion (1) commits any felony under U.S. federal law; (2) gives deliberately false, incomplete, or misleading testimony or information; (3) fails to cooperate as set forth in Paragraph 9 of this Agreement; (4) fails to implement compliance measures as set forth in Attachment B of this Agreement; or (5) otherwise fails to perform or fulfill each of Aegerion’s obligations under this Agreement or any supplemental agreements with the Government, Aegerion shall thereafter be subject to prosecution for any federal criminal violation of which the Government has knowledge, including, but not limited to, the charge in the HIPAA Information described in Paragraph 2, which may be pursued by the Government in the United States District Court for the District of Massachusetts or any other appropriate venue. The decision whether conduct or statements of any present or future director, officer, or employee, or any person acting on behalf of, or at the direction of, Aegerion, will be imputed to Aegerion for the purposes of determining whether Aegerion has violated any provision of this Agreement shall be in the sole discretion of the Government. Determination of whether Aegerion has breached the Agreement and whether to pursue prosecution of Aegerion shall be in the Government’s sole discretion and is not subject to

9

review in any court or tribunal. Any such prosecution may be premised on information provided by Aegerion. Any such prosecution relating to conduct known by the Government before the date on which this Agreement was signed that is not time-barred by the applicable statute of limitation on the date of the signing of this Agreement may be commenced against Aegerion, notwithstanding the expiration of the statute of limitation, between the signing of this Agreement and the expiration of the Term plus one year. Thus, by signing this Agreement, Aegerion agrees that the statute of limitation with respect to any such prosecution that is not time barred on the date of the signing of this Agreement shall be tolled for the Term plus one year.

15.                               In the event the Government determines that Aegerion has breached this Agreement, the Government agrees to provide Aegerion with written notice of such breach prior to instituting any prosecution resulting from such breach. Within fourteen (14) days of receipt of such notice, Aegerion shall have the opportunity to respond to the Government in writing to explain the nature and circumstances of such breach, as well as the actions Aegerion has taken to address and remediate the situation, including whether Aegerion believes a breach occurred, whether such breach was material, and whether such breach was knowingly or willfully committed. The Government agrees to consider such explanation in determining whether to institute a prosecution of Aegerion.

16.                               As a contractual remedy, Aegerion and the Government agree that, in the Government’s sole discretion, any breach of this Agreement may lead to the imposition of a monetary payment of up to $15,000 per day for each day Aegerion is in breach of this Agreement (“Stipulated Penalties”). The imposition of Stipulated Penalties will be alternative to instituting a prosecution due to a breach of this Agreement. The Government shall notify Aegerion in writing of Aegerion’s failure to comply and the Government’s exercise of its

10

contractual right to demand payment of the Stipulated Penalties (the “Demand Letter”). The Demand Letter shall set forth: (a) the provision(s) breached; (b) the approximate date of the breach; (c) a description of the breach sufficient to permit Aegerion to cure (as described below); and (d) the amount of Stipulated Penalties claimed by the Government as of the date of the Demand Letter. Within fourteen (14) days after receipt of the Demand Letter, or such other period as the Government may agree in writing, Aegerion will cure the breach to the Government’s reasonable satisfaction (the “Cure Period”). If Aegerion cures the breach within the Cure Period, no Stipulated Penalties shall be due. If Aegerion fails to cure the breach during the Cure Period, Stipulated Penalties calculated from the date of breach to the date of payment shall be payable to the United States within fourteen (14) days. The Stipulated Penalties shall be paid by electronic fund transfer according to wire instructions that will be provided by the Government. A joint reasonable determination by the United States Attorney’s Office for the District of Massachusetts and the United States Department of Justice’s Consumer Protection Branch as to whether Aegerion has failed to cure any breach will be final and non-appealable. Aegerion agrees that the United States District Court for the District of Massachusetts shall have jurisdiction over any action to collect such a penalty. If Aegerion fails to timely make a payment required in this Paragraph, interest (at the rate specified in Title 28, United States Code, Section 1961) shall accrue on the unpaid balance through the date of payment.

17.          The absence of a Demand Letter from the Government is not, and shall not be construed as, evidence of compliance with this Agreement, federal health care program requirements, HIPAA or its associated privacy regulations, or any other applicable laws, policies, or procedures.

11

18.          In the event the Government institutes a prosecution due to Aegerion’s breach of this Agreement: (a) all statements made by or on behalf of Aegerion to the Government or to the Court, including the attached DPA Statement of Facts, and any testimony given by Aegerion before a grand jury, a court, or any tribunal, or at any legislative hearings, whether before or after this Agreement, and any leads derived from such statements or testimony, shall be admissible in evidence in any and all criminal proceedings brought by the Government against Aegerion; and (b) Aegerion shall not assert any claim under the United States Constitution; Rule 11(f) of the Federal Rules of Criminal Procedure; Rule 410 of the Federal Rules of Evidence; or any other federal rule that any such statements or testimony made by or on behalf of Aegerion before or after this Agreement, or any leads derived therefrom, should be suppressed or are otherwise inadmissible.

19.          Aegerion acknowledges that the Government has made no representations, assurances, or promises concerning what sentence may be imposed by the Court if Aegerion breached this Agreement and this matter proceeds to judgment. Aegerion further acknowledges that any such sentence is solely within the discretion of the Court and that nothing in this Agreement binds or restricts the Court in the exercise of such discretion.

20.          This Agreement is between Aegerion and the United States Attorney’s Office for the District of Massachusetts and the Consumer Protection Branch of the United States Department of Justice. This Agreement does not bind any other federal, state, or local prosecuting authorities. Furthermore, this Agreement does not prohibit the United States, any agency thereof, or any third party from initiating or prosecuting any civil or administrative proceedings directly or indirectly involving Aegerion, including, but not limited to, proceedings by the Internal Revenue Service relating to potential civil tax liability.

12

21.          Any notice, certification, resolution, or report to the Government under this Agreement shall be given by personal delivery, overnight delivery by a recognized delivery service, or registered or certified mail, addressed to:

Chief, Health Care Fraud Unit

U.S. Attorney’s Office for the District of Massachusetts

John Joseph Moakley Federal Courthouse

One Courthouse Way

Boston, MA 02210

Director, Consumer Protection Branch

U.S. Department of Justice

450 5th Street, NW

Washington, DC 20530

22.          Any notice to Aegerion under this Agreement shall be given by personal delivery, overnight delivery by a recognized delivery service, or registered or certified mail, addressed to:

Legal Department

Aegerion Pharmaceuticals, Inc.

One Main Street

Suite 800

Cambridge, MA 02142

Joshua S. Levy

Ropes & Gray LLP

Prudential Tower

800 Boylston Street

Boston, MA 02199-3600

23.          Notice shall be effective upon actual receipt by the Government or Aegerion.

24.          The Government’s acceptance of delivery of any notice, certification, resolution, or report referenced in this Agreement, or the absence of any response thereto, is not, and shall not be construed as, evidence of compliance with this Agreement, federal health care program requirements, HIPAA and associated privacy regulations, or any other applicable laws, policies, or procedures.

13

25.          This Agreement, to become effective, must be signed by all of the parties listed below. No promises, agreements, terms, or conditions other than those set forth in this Agreement will be effective unless memorialized in writing and signed by all parties or confirmed on the record before the Court.

14

ATTACHMENT A: DPA STATEMENT OF FACTS

The following DPA Statement of Facts is incorporated by reference as part of the Deferred Prosecution Agreement (this “Agreement”) between the United States Attorney’s Office for the District of Massachusetts and the United States Department of Justice, Consumer Protection Branch (collectively, the “Government”) and AEGERION PHARMACEUTICALS, INC. (“AEGERION”). AEGERION hereby agrees and stipulates that the following information is true and accurate. AEGERION admits, accepts, and acknowledges that it is responsible for the acts of its officers, directors, employees, and agents as set forth below. Should the Government pursue the prosecution that is deferred by this Agreement, AEGERION agrees that it will neither contest the admissibility of, nor contradict, this DPA Statement of Facts in any such proceeding. The following facts establish beyond a reasonable doubt the charge set forth in the HIPAA Information deferred by this Agreement:

1.             From at least January 2013, and continuing through in or about 2015, within the District of Massachusetts, and elsewhere, AEGERION PHARMACEUTICALS, INC. (“AEGERION acting by and through certain of its officers and employees in concert with certain non-AEGERION health professionals, known and unknown, did knowingly conspire, confederate, and agree to violate the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), Title 42, United States Code, Sections 1320d-6(a) and 6(b)(3), by knowingly using and causing to be used unique health identifiers, obtaining individually identifiable health information relating to individuals, and disclosing individually identifiable health information to another person, without patient authorization required by 45 C.F.R. § 164.508(a)(3), with the intent to sell, transfer, or use individually identifiable health information for commercial advantage, personal gain, or malicious harm.

1

2.             At all relevant times, the defendant, AEGERION, was a Delaware corporation with a principal place of business in Cambridge, Massachusetts, and from 2013 to 2015 manufactured and sold the drug Juxtapid (generic name: lomitapide).

3.             The U.S. Food and Drug Administration (“FDA”) approved Juxtapid with an indication for use as an adjunct to a low-fat diet and other lipid-lowering treatments to reduce cholesterol in patients with a rare genetic disorder called homozygous familial hypercholesterolemia, or “HoFH.”

4.             HIPAA was enacted, among other things, to limit the circumstances in which patients’ confidential medical information (“individually identifiable health information” or “protected health information”) could be used or disclosed. HIPAA regulations specifically forbid disclosure or use of individually identifiable health information for marketing without written patient authorization. 45 C.F.R. § 164.508(a)(3). HIPAA and the privacy regulations apply to health plans, health care clearinghouses, and health care providers who transmit any health information in electronic form in connection with a transaction covered by the law and privacy regulations. See 45 C.F.R. §§ 160.102(a) and 103 (defining “covered entity”).

5.             AEGERION officers and sales employees frequently called on physicians, attempting to convince them to prescribe Juxtapid. These physicians maintained records for patients which contained protected health information. Because these physicians were health care providers who transmitted patients’ protected health information in electronic form, they were covered by HIPAA and associated privacy regulations.

6.             At all times relevant to this DPA Statement of Facts, AEGERION officers and sales employees knew that they could not access HIPAA-protected patient information held by physicians without written patient authorizations.

2

7.             AEGERION’s sales employees were not trained medical professionals and were at no time relevant to this DPA Statement of Facts qualified or able to provide medical treatment to patients or to assist physicians in providing medical treatment.

8.             Nevertheless, to market Juxtapid to doctors with patients not previously diagnosed with HoFH, non-medical AEGERION officers and sales employees involved in the sales and marketing of Juxtapid sought to obtain and did obtain and use patients’ protected health information possessed by physicians and their medical staff, without patient authorizations required by HIPAA regulations, for the purpose of marketing Juxtapid to physicians and, at times, directly to patients.

9.             Without obtaining required HIPAA authorizations, many AEGERION sales employees gained access to physicians’ electronic medical record (“EMR”) systems to perform searches to identify patients for whose treatment they could market Juxtapid to physicians and, at times, directly to patients.

10.          Many AEGERION sales employees gained access to protected health information without patient authorization to complete or to assist with the completion of statements of medical necessity to support insurance coverage of prescriptions for Juxtapid.

11.          Many AEGERION sales employees used protected health information obtained from physicians without patient authorization to contact patients to convince them to start Juxtapid therapy.

12.          Many AEGERION sales employees also used protected health information obtained from physicians without patient authorization to contact patients in order to obtain authorization from patients to allow AEGERION customer service personnel to access those patients’ protected health information.

3

13.          Several AEGERION sales employees forged signatures on patient authorizations.

14.          One AEGERION sales representative obtained patient signatures on HIPAA authorizations, written in English, from non-English speaking patients who did not understand the nature of the HIPAA release.

15.          AEGERION sales employees gained access to patients’ HIPAA-protected health information without patient authorization for sales and marketing purposes at the direction of and with the approval of AEGERION’s senior management.

16.          One AEGERION sales executive encouraged AEGERION sales employees to wear surgical scrubs instead of business attire when visiting physicians’ offices in order to facilitate access to HIPAA-protected health information and to patients.

17.          In February 2013, certain AEGERION managers paired with AEGERION sales employees in a competition for the most new prescriptions in a single day. During the competition, AEGERION managers and employees obtained and used patients’ protected health information without patient authorization, including prescriptions for identified patients; one senior AEGERION manager sent a picture of two prescriptions (for pediatric patients without any patient authorization for access to HIPAA-protected health information) and of an EMR query report from a physician’s office including approximately 250 identifiable patients (without any patient authorizations) to the AEGERION sales teams to show his success with his sales representative partner in marketing Juxtapid.

18.          In May 2013, an AEGERION manager told the AEGERION sales force to contact patients who had not authorized direct contact in order to obtain HIPAA releases.

4

19.          AEGERION also conducted “kickers” or bonus sales commission incentive programs for its sales employees, with one of the success criteria being the conversion of non-consented patients to consented patients within five days of obtaining a prescription for Juxtapid.

20.          Some AEGERION sales employees also gave gifts or provided benefits to medical staff in exchange for access to patient data, all in furtherance of marketing Juxtapid to physicians.

21.          As a result of AEGERION’s efforts to obtain and success in obtaining HIPAA-protected health information from physicians without patient authorization for hundreds of individuals, including patients under 18 years of age, AEGERION marketed Juxtapid to numerous physicians and patients, all for the purpose of commercial gain to AEGERION.

5

ATTACHMENT B: COMPLIANCE PROGRAM AND CERTIFICATIONS

Aegerion Pharmaceuticals, Inc. (“Aegerion”) agrees to the provisions set forth in this Attachment, which is incorporated by reference as part of the Deferred Prosecution Agreement (the “Agreement”) between the United States Attorney’s Office for the District of Massachusetts and the United States Department of Justice, Consumer Protection Branch (collectively, “the Government”) and Aegerion. Aegerion recognizes that each of the terms in this Attachment constitutes a material term of the Deferred Prosecution Agreement.

Compliance and Ethics Program

1.             Aegerion will maintain a Compliance and Ethics Program that governs Aegerion’s business operations. The purpose of the Compliance and Ethics Program is to (a) prevent, detect, and correct violations of law and company policy and procedures; (b) assure the continuation of compliance-related policies and procedures for business operations; (c) assure the continued development of training and other programs designed to educate employees regarding applicable policies, procedures, and standards; (d) conduct auditing and monitoring of the effectiveness of applicable policies, procedures, and standards; (e) assure that there is a mechanism for internal reporting of questionable or inappropriate activities to enable timely investigation and resolution; and (f) assure that appropriate corrective action is taken to prevent recurrence of misconduct.

2.             Aegerion’s Compliance and Ethics Program will consist of a Vice President Ethics and Compliance (“Compliance Officer”) who reports to the President of Aegerion and the Global Chief Compliance Officer of Novelion Therapeutics Inc.; a Compliance Committee composed of Aegerion management (e.g., executives of relevant departments) that meets at least quarterly; a comprehensive set of written compliance policies and procedures governing the

1

conduct of its employees; a training program focused on the company’s compliance policies and procedures; a disclosure program to allow employees to report potential violations of law or the company’s compliance policies and procedures; a non-retaliation policy; and a monitoring and auditing program designed to deter and detect compliance issues. The Compliance Officer is responsible for overseeing the administration and implementation of the Compliance and Ethics Program. The Compliance Officer reports at least quarterly on the Compliance and Ethics Program to the Compliance Committee. The Compliance Officer has direct access to senior executives vested with the authority to direct and implement compliance-related changes in Aegerion as necessary. The Compliance Officer has the authority to exercise independent judgment in assessing compliance-related matters. The Compliance Officer has authority to seek advice from outside legal counsel or other outside experts when appropriate. The Compliance Officer is authorized to report issues of any kind directly to the Board of Directors of Novelion Therapeutics Inc. (or a Committee thereof).

3.                                      The Compliance and Ethics Program will include and maintain compliance policies and procedures designed to prevent, detect, and correct violations of HIPAA and its associated privacy regulations, including, but not limited to, the following subjects:

a.                                      Impermissible Access to Patient Information: Aegerion will implement and maintain a policy prohibiting its sales agents from accessing and reviewing patient information (or otherwise consulting with health care providers) to identify potential patients for treatment with Aegerion’s products without patient consent as required by HIPAA or otherwise permitted under HIPAA.

2

b.                                      Sales Compensation and Incentives: Aegerion will establish and maintain policies and procedures that shall require that financial incentives do not improperly motivate field-facing sales representatives or their direct managers to engage in improper promotion, sales, and marketing of Aegerion’s products (including accessing protected health information or representing themselves to be involved in the diagnosis and treatment of patients). Aegerion shall exclude from incentive compensation any sales under circumstances indicating that improper promotion of Aegerion’s products occurred, such as the impermissible accessing of protected patient information, and shall not offer or provide any other financial reward to its sales representatives or their managers based upon or involving patient authorization of Aegerion’s access to protected health information.

Notice to Health Care Providers and Entities

4.                                      Within sixty (60) days after the Effective Date of this Agreement, Aegerion shall send, by first class mail, postage prepaid with delivery confirmation, a notice containing the language set forth below to all health care providers (a) who are or who have previously been certified to prescribe Juxtapid under the Juxtapid REMS program, (b) who submitted a prescription for Juxtapid, (c) who made a medical information request concerning Juxtapid, (d) who participated in an Aegerion-sponsored speaker program concerning Juxtapid, or (e) who submitted a grant proposal concerning Juxtapid. This notice shall be dated and shall be signed by Aegerion’s Board Chair. The body of the notice shall state the following:

As you may be aware, Aegerion Pharmaceuticals, Inc. recently entered into civil, criminal, and administrative settlements with the United States

3

of America and individual states in connection with Aegerion’s promotion of its product Juxtapid. This letter provides you with additional information about the global settlement, explains Aegerion’s commitments going forward, and tells you how to obtain more information about those commitments.

Aegerion pleaded guilty to violating the Federal Food, Drug, and Cosmetic Act and agreed to pay approximately $7 million in criminal fines and forfeiture. Aegerion also entered into a three-year Deferred Prosecution Agreement to resolve claims that it violated the Health Insurance Portability and Accountability Act of 1996 (HIPAA). Separately, Aegerion agreed to enter into a Civil Consent Decree of Permanent Injunction to be monitored by the U.S. Food and Drug Administration (FDA).

In addition, the federal government and several individual states alleged that Aegerion’s conduct violated the federal False Claims Act and equivalent state statutes. To resolve those allegations, Aegerion entered into a separate civil False Claims Act settlement whereby Aegerion agreed to reimburse federal and state health care programs approximately $29 million. As part of the settlement, Aegerion also entered into a five-year corporate integrity agreement with the Office of Inspector General of the U.S. Department of Health and Human Services.

Finally, the Securities and Exchange Commission alleged that Aegerion’s conduct violated federal security statutes. To resolve those allegations, Aegerion entered into a separate civil securities settlement whereby Aegerion agreed to pay approximately $4 million.

More information about these settlements may be found at the following websites:

https://www.justice.gov/civil/current-and-recent-cases#_Pharm2

http://oig.hhs.gov/fraud/cia/index.html

Please call Aegerion at ###-###-#### or visit us at http://novelion.com/about-novelion/aegerion-pharmaceuticals/aegeriongovernment-settlement if you have questions about the settlement referenced above. Please call Aegerion at ###-###-#### or visit us at https://novelioncompliance.tnwreports.com to report any instances in which you believe that an Aegerion representative inappropriately promoted a product or engaged in other questionable conduct.

5.                                      The Compliance Officer (or a designee) shall maintain a log (the “Log”) of all calls and messages received by the Compliance and Ethics Program through its disclosure

4

program that report questionable practices by Aegerion employees concerning HIPAA and associated privacy regulations, including any such calls or messages made in response to the notice above. The Log shall include a record and summary of each call and message received (whether anonymous or not), the status of the call or message, and any corrective action taken in response to the call or message. Aegerion shall produce the Log to the United States within fourteen (14) days of a written request for such production.

Certifications and Board Resolution

6.                                      Aegerion will conduct the reviews described in Paragraphs 7 through 9 below for each of three (3) Review Periods. The duration of the first and second Review Periods each will be one year, beginning with the first one-year period following the Effective Date of this Agreement. The duration of the third Review Period will be nine months. Aegerion will provide the certifications and resolutions described in Paragraphs 7 through 9 below to the Government within one hundred twenty (120) days following the end of each of the first and second Review Periods, and within sixty (60) days following the end of the third Review Period.

7.                                      Following the end of each Review Period, the Compliance Officer shall conduct a review of the Log described in Paragraph 5 above for the preceding Review Period. Based on his or her review, the Compliance Officer shall submit to the Government a signed certification (the “Log Certification”) (a) stating that, to the best of his or her knowledge, during the preceding Review Period, Aegerion maintained the Log pursuant to this Agreement; and (b) stating the total number of calls and messages received by the Compliance and Ethics Program through its disclosure program, including any such calls or messages made in response to the notice in Paragraph 4, and the number of those calls and messages that relate to HIPAA and its associated privacy regulations for each month of the preceding Review Period.

5

8.                                      Following the end of each Review Period, the President of Aegerion shall conduct a review of the effectiveness of the Compliance and Ethics Program for the preceding Review Period. Based on his or her review, the President of Aegerion shall submit to the Government a signed certification stating that, to the best of his or her knowledge based on a reasonable inquiry, during the preceding Review Period, the Compliance and Ethics Program was effective in identifying and preventing violations of federal health care program requirements, HIPAA, and associated privacy regulations. The certification shall summarize the review described above. If the President of Aegerion is unable to certify that the Compliance and Ethics Program was effective in preventing violations of federal health care program requirements, HIPAA, and associated privacy regulations, he or she shall provide a detailed explanation of why the Compliance and Ethics Program was not effective, and will state the steps Aegerion is taking to ensure the effectiveness of the Compliance and Ethics program.

9.                                      Following the end of each Review Period, the Board of Directors of Novelion Therapeutics Inc. (or any future parent company of Aegerion), or a designated Committee thereof (the “Board”), shall conduct a review of the effectiveness of the Compliance and Ethics Program for the preceding Review Period. This review shall include, but not be limited to, updates and reports by the Compliance Officer and other personnel regarding compliance matters. The Board shall evaluate the effectiveness of the Compliance and Ethics Program, including, at a minimum, by receiving updates about the activities of the Compliance Officer and Compliance Committee and updates about the adoption and implementation of policies, procedures, and practices to ensure compliance with applicable federal health care program requirements, HIPAA, and associated privacy regulations. Based on its review, the Board shall

6

submit to the Government a resolution that summarizes its review and oversight as set forth above and that includes, at a minimum, the following language:

The Board of Directors of Novelion Therapeutics Inc. [or any future parent company of Aegerion] (or a designated Committee of the Board) has made a reasonable inquiry as described in Attachment B of the Deferred Prosecution Agreement with Aegerion into the operations of the Compliance and Ethics Program for the preceding Review Period, [insert date range], including the performance of the Compliance Officer and the Compliance Committee. Based on its reasonable inquiry and review, the Board has concluded that, to the best of its knowledge, Aegerion has implemented an effective compliance program, as defined in the United States Sentencing Commission Guidelines Manual, Chapter 8: Sentencing of Organizations, to meet the requirements of federal health care programs, the Health Insurance Portability and Accountability Act of 1996 and its associated privacy regulations, and as set forth in the Deferred Prosecution Agreement.

If the Board is unable to provide any part of this statement, it shall include in the resolution a written explanation of the reasons why it is unable to provide such a statement.

10.                               Aegerion agrees that, in the event that the Government shortens or extends the Term of this Agreement pursuant to Paragraph 3 of the Deferred Prosecution Agreement, an increase or decrease in the duration of the Review Periods described in Paragraph 6 above, and an increase or decrease in the total number of reviews required by Paragraphs 7 through 9 above, may be required by the Government, in its sole discretion, and upon notice to Aegerion.

Additional Reporting Obligations

11.                               Fifteen (15) days after the end of each calendar quarter (that is, by January 15 for the calendar quarter ending December 31, April 15 for the calendar quarter ending March 31, July 15 for the calendar quarter ending June 30, and October 15 for the calendar quarter ending September 30), excepting any calendar quarter that ends within sixty (60) days of the end of the Term of this Agreement, Aegerion shall submit a report to the Government in writing stating whether any Reportable Events have been determined to have occurred during the preceding

7

calendar quarter, and providing updated information about Reportable Events that Aegerion determined to have occurred during any prior calendar quarter, as may be necessary in the reasonable determination of Aegerion or at the Government’s request. A Reportable Event is any matter that, after a reasonable opportunity to conduct an appropriate review or investigation of the allegations, a reasonable person would consider a probable violation of HIPAA, 42 U.S.C. § 1320d-6, and its associated privacy regulations. A Reportable Event may be the result of an isolated event or a series of occurrences. The written report to the Government shall include: (a) a description of the Reportable Event, including the relevant facts, the positions of the persons involved, and the legal authorities implicated; (b) a description of Aegerion’s actions taken to investigate and correct the Reportable Event; and (c) a description of any further steps Aegerion plans to take to address the Reportable Event and prevent it from recurring. The Compliance Officer shall promptly report to the President of Aegerion any Reportable Event determined to have occurred by Aegerion. The Compliance Officer shall directly and promptly report to the Board (or a designated Committee of the Board), and record in writing, any allegation concerning a Reportable Event that involves any Aegerion employee with senior managerial responsibilities.

Filing of Certifications, Resolutions, and Reports(1)

12.                               The certifications referenced above in Paragraphs 7 and 8 above shall be sworn to under penalty of perjury and shall set forth that the representations contained therein may be

(1) Consistent with the U.S. Department of Justice’s Freedom of Information Act (“FOIA”) procedures, the Government shall make reasonable effort to notify Aegerion prior to any release by the Department of Justice of information submitted by Aegerion pursuant to its obligations under this Plea Agreement and identified upon submission of Aegerion as trade secrets, or information that is commercial or financial and privileged or confidential, under the FOIA rules. With respect to such releases, Aegerion shall have the rights set forth under said procedures.

8

provided to, relied upon, and material to the government of the United States, and that a knowing false statement could result in criminal or civil liability for the signatory.

13.                               Aegerion may submit a timely written request for an extension of time to provide the certifications, resolutions, or reports required by Paragraphs 6 through 9 and Paragraph 11 above. A written request is timely if it is received by the U.S. Attorney’s Office for the District of Massachusetts and the Consumer Protection Branch, U.S. Department of Justice, at least five business days prior to the date by which the certification, resolution or report is due. Timely requests for extension will not be unreasonably denied. If an extension of time is granted in writing, Stipulated Penalties as described in Paragraph 16 of the Deferred Prosecution Agreement shall not accrue until one day after Aegerion fails to meet the revised deadline. If not granted, Stipulated Penalties shall not begin to accrue until three (3) business days after Aegerion received the Government’s written denial of such request or the original deadline, whichever is later.

9

ATTACHMENT C: CERTIFICATE OF CORPORATE RESOLUTIONS

WHEREAS, Aegerion Pharmaceuticals, Inc. (“Aegerion”) has been engaged in discussions with the United States Attorney’s Office for the District of Massachusetts and the United States Department of Justice, Consumer Protection Branch (collectively, the “United States”) regarding issues arising in relation to its sale and distribution of the drug, Juxtapid; and

WHEREAS, in order to resolve such discussions, it is proposed that Aegerion enter into a certain agreement with the Government; and

WHEREAS, outside counsel for Aegerion has advised the Board of Directors of Aegerion of its rights, possible defenses, the U.S. Sentencing Guidelines’ provisions, and the consequences of entering into such agreement with the United States;

Therefore, the Board of Directors has RESOLVED that:

1.                                      Aegerion (a) acknowledges the filing of the one-count Information charging Aegerion with conspiracy to violate Title 42, United States Code, Sections 1320d-6(a) and 6(b)(3), in violation of Title 18, United States Code, Section 371; and (b) waives indictment on such charges and enters into a deferred prosecution agreement with the United States.

2.                                      Aegerion accepts the terms and conditions of this Agreement, including, but not limited to, (a) a knowing waiver of its rights to a speedy trial pursuant to the Sixth Amendment to the United States Constitution, Title 18, United States Code, Section 3161, and Federal Rule of Criminal Procedure 48(b); (b) a knowing waiver for purposes of this Agreement and any charges by the United States arising out of the conduct described in the attached Statement of Facts of any objection with respect to venue and consent to the filing of the Information, as provided under the terms of this Agreement, in the United States District Court for the District of Massachusetts; and (c) a knowing waiver of any defenses based on the statute of limitations for

1

any prosecution relating to the conduct described in the attached Statement of Facts or relating to conduct known to the United States prior to the date on which this Agreement was signed that is not time-barred by the applicable statute of limitations on the date of the signing of this Agreement;

3.                                      The Vice President, Corporate Counsel of Aegerion, Jennifer Fitzpatrick, is hereby authorized, empowered and directed, on behalf of Aegerion to execute the Deferred Prosecution Agreement substantially in such form as reviewed by this Board of Directors at this meeting with such changes as the Vice President, Corporate Counsel of Aegerion, Jennifer Fitzpatrick, may approve;

4.                                      The Vice President, Corporate Counsel of Aegerion, Jennifer Fitzpatrick, is hereby authorized, empowered and directed to take any and all actions as may be necessary or appropriate and to approve the forms, terms or provisions of any agreement or other documents as may be necessary or appropriate, to carry out and effectuate the purpose and intent of the foregoing resolutions; and

5.                                      All of the actions of the Vice President, Corporate Counsel of Aegerion, Jennifer Fitzpatrick, which actions would have been authorized by the foregoing resolutions except that such actions were taken prior to the adoption of such resolutions, are hereby severally ratified, confirmed, approved, and adopted as actions on behalf of Aegerion.

2