Company: QTIWW
Filing Date: 2025-02-05
Form Type: 424B3
Source: 0001628280-25-004061
Chunk: 244

Company: QT IMAGING HOLDINGS, INC.
Filing Date: 2025-02-05
Form: 424B3
Chunk 244
---
 case back to the District Court to determine whether the remaining provisions of the ACA are invalid as well. However, the decision of the U.S. Court of Appeals for the 5th Circuit was appealed to the U.S. Supreme Court. On June 17, 2021, the U.S. Supreme Court held that the states that initially commenced the challenge to the ACA didn’t have standing to challenge the law, effectively ending this challenge. But it remains possible that future challenges to the ACA may be brought, and it is unclear how any future decisions and other efforts to repeal and replace the ACA will impact the ACA.

Other legislative changes have been proposed and adopted in the United States since the ACA was enacted, including aggregate reductions of Medicare payments to providers of 2% per fiscal year and reduced payments to several types of Medicare providers. We believe the overall escalating cost of medical products and services being paid for by the government and private health insurance has led to, and will continue to lead to, increased pressures on the healthcare and medical device industry to reduce the costs of products and services.

Data Privacy and Security

Medical device companies may be subject to U.S. federal and state and foreign health information privacy, security and data breach notification laws, which may govern the collection, use, disclosure and protection of health-related and other personal information. In the U.S., HIPAA imposes privacy, security and breach reporting obligations with respect to individually identifiable health information upon “covered entities” (health plans, health care clearinghouses and certain health care providers), and their respective business associates, individuals or entities that create, receive, maintain or transmit protected health information in connection with providing a service for or on behalf of a covered entity. HIPAA and its respective implementing regulations, including the final omnibus rule published on January 25, 2013, imposes specified requirements relating to the privacy, security and transmission of individually identifiable health information. HIPAA mandates the reporting of certain breaches of health information to HHS, affected individuals and if the breach is large enough, the media. Entities that are found to be in violation of HIPAA as the result of a breach of unsecured protected health information (“

#### PHI
”), a complaint about privacy practices or an audit by HHS, may be subject to significant civil, criminal and administrative fines and penalties and/or additional reporting and oversight obligations if required to enter into a resolution agreement and corrective action plan with HHS to settle allegations of HIPAA non-compliance. The Health Information Technology and Clinical Health Act also increased the civil and