Company: BLLN
Filing Date: 2025-10-17
Form Type: S-1/A
Source: 0001193125-25-242632
Chunk: 260

Company: BillionToOne, Inc.
Filing Date: 2025-10-17
Form: S-1/A
Chunk 260
---
 by California’s DHS, California law is applicable to our business arrangements.
California’s state anti-kickback statutes, Business and Professions Code Section 650 (which applies to all categories of payors) and Insurance Code Section 754, and its Medi-Cal anti-kickback statute, Welfare and Institutions Code
Section 14107.2, are analogous to, and have been interpreted by the California Attorney General and California courts in substantially the same way as the federal government and the courts have interpreted, the federal Anti-Kickback Statute. A
violation of Section 650 is punishable by up to one year of imprisonment, a fine up to $50,000, or both imprisonment and a fine. A violation of Section 14107.2 is punishable by imprisonment and fines of up to $10,000. The California
Insurance Code includes similar prohibitions against any consideration for the referral or procurement of patients if a claim is submitted to a commercial insurer, CA Ins. Code § 750, which is punishable by criminal penalties mirroring those
that apply to violations of Business and Professions Code Section 650.

Because each of our laboratories holds a New York CLEP permit, we must comply with New
York state laboratory statutes and regulations, which include anti-kickback provisions, Public Health Law Section 587, and Medicaid anti-kickback provisions, 18 NYCRR Section 515.2, related to laboratory services. The New York DOH may
suspend, limit, revoke or annul the New York laboratory permit or otherwise discipline the permit holder for a violation.

Data Privacy & Security

We are, or
may become, subject to numerous federal, state, local and foreign laws, regulations, standards, and guidance regarding data privacy and security.

190

The federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) created federal criminal statutes
relating to privacy of personal data. HIPAA imposes privacy, security and breach reporting obligations with respect to individually identifiable health information upon “covered entities” (health plans, health care clearinghouses and
certain health care providers), and their respective business associates, individuals or entities that create, received, maintain or transmit protected health information in connection with providing a service for or on behalf of a covered entity.
HIPAA mandates the reporting of certain breaches of health information to HHS, affected individuals and if the breach is large enough, the media. Entities that are found to be in violation of HIPAA, including as the result of a breach