Company: QTIWW
Filing Date: 2025-01-31
Form Type: S-1/A
Source: 0001628280-25-003316
Chunk: 245

Company: QT IMAGING HOLDINGS, INC.
Filing Date: 2025-01-31
Form: S-1/A
Chunk 245
---
 media. Entities that are found to be in violation of HIPAA as the result of a breach of unsecured protected health information (“ PHI ”), a complaint about privacy practices or an audit by HHS, may be subject to significant civil, criminal and administrative fines and penalties and/or additional reporting and oversight obligations if required to enter into a resolution agreement and corrective action plan with HHS to settle allegations of HIPAA non-compliance. The Health Information Technology and Clinical Health Act also increased the civil and criminal penalties that may be imposed against covered entities, business associates and possibly other persons, and gave state attorneys general new authority to file civil actions for damages or injunctions in federal courts to enforce the federal HIPAA laws and seek attorney’s fees and costs associated with pursuing federal civil actions.

Even when HIPAA does not apply, according to the FTC, failing to take appropriate steps to keep consumers’ personal information secure constitutes unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act, 15 U.S.C § 45(a). The FTC expects a company’s data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities. Individually identifiable health information is considered sensitive data that merits stronger safeguards. The FTC’s guidance for appropriately securing consumers’ personal information is similar to what is required by the HIPAA Security Rule.

In addition, certain state and non-U.S. laws, such as the GDPR, govern the privacy and security of health information in certain circumstances, some of which are more stringent than HIPAA and many of which differ from

<div align='center'>165</div>

each other in significant ways and may not have the same effect, thus complicating compliance efforts. Further, “business associates,” defined as independent contractors or agents of covered entities that create, receive, maintain or transmit protected health information in connection with providing a service for or on behalf of a covered entity, are also subject to certain HIPAA privacy and security standards. Failure to comply with these laws, where applicable, can result in the imposition of significant civil and/or criminal penalties and private litigation. For example, California recently enacted legislation, the CCPA, which went into effect January 1, 2020. The CCPA, among other things, creates new data privacy obligations for covered companies and provides new privacy rights to California residents, including the right to opt out of certain disclosures