Company: TVRD
Filing Date: 2025-02-14
Form Type: 424B3
Source: 0001104659-25-014310
Chunk: 452

Company: Tvardi Therapeutics, Inc.
Filing Date: 2025-02-14
Form: 424B3
Chunk 452
---
 covering up by trick, scheme or device a

<div align='center'>260</div>

TABLE OF CONTENTS

material fact or making any materially false, fictitious or fraudulent statement in connection with the delivery of or payment for healthcare benefits, items or services relating to healthcare matters. Also, many states have similar fraud and abuse statutes or regulations that apply to items and services reimbursed under Medicaid and other state programs, or, in several states, apply regardless of the payer.

In addition, Cara is or may become subject to data privacy and security regulations by both the U.S. federal government and the state governments in which Cara conducts its business. HIPAA, as amended by HITECH and their respective implementing regulations, including the Final HIPAA Omnibus Rule published on January 25, 2013, imposes specified requirements on certain types of individuals and entities subject to the law, known as covered entities, such as certain healthcare providers, health plans, and healthcare clearinghouses, as well as their business associates that process individually identifiable health information on their behalf, relating to the privacy, security and transmission of individually identifiable health information as well as their covered subcontractors. Among other things, HITECH makes security standards and certain privacy standards directly applicable to the business associates of covered entities that perform services for them that involve the creation, use, maintenance or disclosure of, individually identifiable health information. HITECH also created four new tiers of civil monetary penalties, amended HIPAA to make civil and criminal penalties directly applicable to business associates, and gave state attorneys general new authority to file civil actions for damages or injunctions in federal courts to enforce the federal HIPAA laws and seek attorney’s fees and costs associated with pursuing federal civil actions. In addition, Cara is or may become subject to U.S. state laws (such as the California Consumer Privacy Act of 2018 (CCPA) and foreign laws (such as the EU’s General Data Protection Regulation 2016/679 (EU GDPR), the EU GDPR as it forms part of UK law by virtue of section 3 of the European Union (Withdrawal) Act 2018 (UK GDPR) that govern data privacy, security and protection. Many of these laws differ from each other in significant ways and may not have the same effect, both of which complicate compliance efforts to the extent Cara is or may become subject to these laws.

Additionally, federal transparency laws, including the federal Physician Payments Sunshine Act created under Section 6002 of the Health Care Reform Law and its implementing regulations, require that