Company: BLLN
Filing Date: 2025-12-10
Form Type: 10-Q
Source: 0001628280-25-056321
Chunk: 298

Company: BillionToOne, Inc.
Filing Date: 2025-12-10
Form: 10-Q
Item: Part II, Item 1A
Chunk 298
---
, a complaint about privacy practices or an audit by the U.S. Department of Health and Human Services (HHS) can be subject to significant civil, criminal and administrative fines and penalties and/or additional reporting and oversight obligations if required to enter into a resolution agreement and corrective action plan with HHS to settle allegations of HIPAA non-compliance. While HIPAA does not create a private right of action allowing individuals to sue us in civil court for violations of HIPAA, its standards have been used as the basis for duty of care in state civil suits such as those for negligence or recklessness in the misuse or breach of PHI. A person who knowingly obtains or discloses individually identifiable health information in violation of HIPAA may face additional fines and up to one-year imprisonment. In addition, our responding to government investigations regarding alleged violations of these and other laws and regulations, even if ultimately successful, can consume company resources, impact our business and, if public, harm our reputation.

Further, various states have implemented similar privacy laws and regulations, such as the California Confidentiality of Medical Information Act, that impose restrictive requirements regulating the use and disclosure of health information and other personally identifiable information. In addition, certain state laws may require us under certain circumstances to provide information, upon request, regarding the manner in which we share certain categories of personal information with third parties for marketing or other purposes (e.g. California Shine the Light law). These laws and regulations are not necessarily preempted by HIPAA, and where state laws are more protective, we may have to comply with the stricter provisions. These state data privacy laws are not consistent, and compliance in the event of a widespread data breach is costly. In addition to fines and penalties potentially imposed upon violators, some of these state laws also afford private rights of action to individuals who believe their personal information has been misused. Furthermore, the FTC, and certain state Attorneys General can enforce federal or state consumer protection laws against companies for online collection, use, dissemination and security practices that appear to be unfair or deceptive. The interplay of federal and state laws may be subject to varying interpretations by courts and government agencies.

Our employees and personnel use generative artificial intelligence (AI) and machine learning (ML) technologies (collectively, AI/ML) to perform their work, and the disclosure and use of personal data in AI/ML is subject to various privacy laws and other privacy obligations. We use AI/ML for a variety of internal processes, including to draft sales emails, conduct product research, automate reimbursement processing