Company: BLLN
Filing Date: 2025-09-17
Form Type: DRS/A
Source: 0001193125-25-206347
Chunk: 88

Company: BillionToOne, Inc.
Filing Date: 2025-09-17
Form: DRS/A
Chunk 88
---
 us. The cost of compliance with these laws, regulations and standards is high and is likely to increase in the
future. Any failure or perceived failure by us to comply with laws or regulation, our internal policies and procedures or our contracts governing processing of personal information could result in negative publicity, government investigations and
enforcement actions, claims by third parties and damage to our reputation, any of which could have a material adverse effect on our operations, financial performance and business.

We are a covered entity under HIPAA, and therefore, must comply with its requirements to protect the privacy and security of PHI and must provide individuals with
certain rights with respect to their PHI. We currently, and will in the future, engage business associates to help us carry out healthcare activities and functions. For each such business associate, we must have a written business
associate contract or other arrangement with the business associate that requires the business associate to comply with the same standards and safeguards and other requirements under HIPAA. We cannot guarantee that our security safeguards or those
of our business associates will not fail or that they will not be deemed inadequate in the future. Determining whether PHI has been handled in compliance with applicable privacy standards and our contractual obligations can be complex and we cannot
be sure how these regulations will be interpreted, enforced or applied to our operations.

Entities that are found to be in violation of HIPAA as the result of a
breach of unsecured PHI, a complaint about privacy practices or an audit by the U.S. Department of Health and Human Services (HHS) can be subject to significant civil, criminal and administrative fines and penalties and/or additional reporting and
oversight obligations if required to enter into a resolution agreement and corrective action plan with HHS to settle allegations of HIPAA non-compliance. While HIPAA does not create a private right of action
allowing individuals to sue us in civil court for violations of HIPAA, its standards have been used as the basis for duty of care in state civil suits such as those for negligence or recklessness in the misuse or breach of PHI. A person who
knowingly obtains or discloses individually identifiable health information in violation of HIPAA may face additional fines and up to one-year imprisonment. In addition, our responding to government
investigations regarding alleged violations of these and other laws and regulations, even if ultimately successful, can consume company resources, impact our business and, if public, harm our reputation.

Further, various states have implemented similar privacy laws and regulations, such as the California Confidentiality