Company: SCLXW
Filing Date: 2025-12-29
Form Type: 424B3
Source: 0001193125-25-335429
Chunk: 328

Company: Scilex Holding Co
Filing Date: 2025-12-29
Form: 424B3
Chunk 328
---
6 and its implementing regulations (“HIPAA”) impose criminal liability for, among other things, knowingly and willfully executing, or attempting to execute, a scheme to defraud any health care benefit program,
including private third-party payors, or falsifying or covering up a material fact or making any materially false or fraudulent statement in connection with the delivery of or payment for health care benefits, items or services.

We may be subject to, or our marketing activities may be limited by, data privacy and security law and regulation promulgated by both the U.S.
federal government and the U.S. states in which we conduct our business. For example, under HIPAA, the U.S. Department of Health and Human Services imposes upon “covered entities” (broadly, healthcare providers, health plans and
healthcare clearinghouses) and their respective “business associates” (individuals or entities that create, receive, maintain or transmit protected health information on behalf of a covered entity) the HIPAA Privacy and Security Rules
which include privacy obligations; requirements to implement appropriate administrative, physical and technical safeguards to ensure the confidentiality, integrity, and security of electronic protected health information; and breach response
notification obligations. Although we are neither a covered entity nor business associate, and therefore not subject to the HIPAA Privacy and Security Rules, we must monitor developments with these requirements for changing obligations that may
apply to us. The Federal Trade Commission (the “FTC”) also requires companies to take appropriate steps to keep consumers’ personal information secure and to make accurate statements regarding how they secure personal information
under their custody or control, such as in a privacy notice. The FTC also expects a company’s data security measures to be reasonable and appropriate in light of the sensitivity and volume of personal information it holds, the size and
complexity of its business, and the cost of available tools to improve data security and reduce vulnerabilities. Individually identifiable health information, which we process, is considered sensitive data that merits stronger safeguards. Violations
of the foregoing FTC requirements may constitute unfair or deceptive acts or practices under Section 5(a) of the Federal Trade Commission Act (the “FTC Act”). While we do not intend to engage in unfair or deceptive acts or
practices, the FTC has the power to bring enforcement actions based on the FTC’s interpretation of public privacy statements. Further, events that we cannot fully control, such as data breaches, may also result in civil penalties, FTC
enforcement or enforcement by U.S. state attorneys general or