Company: BLLN
Filing Date: 2025-10-17
Form Type: S-1/A
Source: 0001193125-25-242632
Chunk: 262

Company: BillionToOne, Inc.
Filing Date: 2025-10-17
Form: S-1/A
Chunk 262
---
, some of which are more stringent
than HIPAA and many of which differ from each other in significant ways and may not have the same effect, thus complicating compliance efforts. Many states are considering similar laws. Failure or perceived failure to comply with these laws, where
applicable, can result in material adverse effects to our business, including the imposition of significant civil and/or criminal penalties and private litigation.

As a health care provider, we are also subject to Section 4004 of the 21 Century Cures Act, or Cures Act, and
regulations promulgated by HHS related to patient access to electronic PHI, or EHI, to promote interoperability and to ensure the access, exchange, or use of EHI.

Various U.S. states have implemented similar restrictive requirements regulating the use and disclosure of health information and other personal information that are not
necessarily preempted by HIPAA or that regulate different information than HIPAA. The California Consumer Privacy Act (CCPA), which went into effect January 1, 2020, and California Privacy Rights Act of 2020 (CPRA), which went into effect on
January 1, 2023,

191

which created additional obligations with respect to certain data relating to consumers, significantly expands the CCPA, is an example of the increasingly stringent privacy laws at the state
level in the United States. The CCPA also created a private right of action with statutory damages for certain data breaches, thereby potentially increasing risks associated with a data breach. However, the CCPA and CPRA include an exemption for
HIPAA covered entities such as our laboratory. The California Confidentiality of Medical Information Act, which protects the confidentiality of individually identifiable medical information obtained by health care providers and their contractors, is
much broader than HIPAA and the data protected is also broader than HIPAA.

In addition, numerous other states’ legislatures have passed or are considering
similar laws that will require ongoing compliance efforts and investment. For example, Virginia passed the Virginia Consumer Data Protection Act, and Colorado passed the Colorado Privacy Act, both of which differ from the CPRA and became effective
in 2023 and the Texas Data Privacy and Security Act became effective in 2024. These state privacy laws dictate how we can collect, use, store, sell, share, analyze or process personal identifying information and/or consumer or health data received
or generated by our business operations.

Outside the United States, there are an increasing number of laws and regulations governing the collection, use and