Company: HROW
Filing Date: 2025-03-27
Form Type: 10-K
Source: 0001641172-25-000925
Chunk: 25

Company: HARROW, INC.
Filing Date: 2025-03-27
Form: 10-K
Item: Item 1
Chunk 25
---
 503B
facility and to the extent we are unable to demonstrate compliance with cGMPs and other required regulations, the government could
pursue enforcement actions, the effects of which could be costly to us and could result in adverse consequences to our
business.”

We prepare our compounded formulations
in accordance with the standards provided by USP <795> and USP <797> and applicable state and federal law. In November 2023,
USP made effective finalized revisions to USP <795> and USP <797>, which had been previously proposed for public comment
in September 2021. The revisions include limitations on beyond use dating of sterile and preservative-free products and batch sizes,
among other changes. Some regulatory bodies such as state boards of pharmacy adopted these changes at that time, and some have not or
plan to on different dates, on a case-by-case basis. The revisions to USP <797> has had little impact to our business.

Confidentiality, Privacy and HIPAA

Our pharmacy operations involve
the receipt, use and disclosure of confidential medical, pharmacy and other health-related information. In addition, we use aggregated
and blinded (anonymous) data for research and analysis purposes. The federal privacy regulations under HIPAA are designed to protect
the medical information of a healthcare patient or health plan enrollee that could be used to identify the individual. Among other things,
HIPAA limits certain uses and disclosures of protected health information and requires compliance with federal security regulations regarding
the storage, utilization and transmission of and access to electronic protected health information. The requirements imposed by HIPAA
are extensive. In addition, most states and certain other countries have enacted privacy and security laws that protect identifiable
patient information that is not health-related. For example, California recently enacted the California Consumer Privacy Act (the “CCPA”)
that creates new individual privacy rights for consumers and places increased privacy and security obligations on entities handling personal
data of consumers or households. Effective January 1, 2020, the CCPA gives California residents expanded privacy rights and protections,
and provides civil penalties for violations and a private right of action for data breaches. The CCPA exemplifies the vulnerability of
our business to not only cyber threats but also the evolving regulatory environment related to personal data and protected health information.
In addition, the California Invasion of Privacy Act prohibits the use of “any machine, instrument, or contrivance” to tap
any telephonic communication and use of any “electronic amplifying or