Company: BLLN
Filing Date: 2025-06-20
Form Type: DRS
Source: 0000950123-25-006095
Chunk: 207

Company: BillionToOne, Inc.
Filing Date: 2025-06-20
Form: DRS
Chunk 207
---
 “business associates” that create,
receive, maintain or transmit individually identifiable health information for or on behalf of a covered entity, with respect to safeguarding the privacy, security and transmission of individually identifiable health information. Additionally,
HITECH created four new tiers of civil monetary penalties, amended HIPAA to make civil and criminal penalties directly applicable to business associates, and gave state attorneys general new authority to file civil actions for damages or injunctions
in U.S. federal courts to enforce HIPAA and seek attorneys’ fees and costs associated with pursuing federal civil actions.

Even when HIPAA does not apply,
failing to take appropriate steps to keep consumers’ personal information secure may constitute unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act, 15 U.S.C § 45(a). The
FTC expects a company’s data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve
security and reduce vulnerabilities.

163

Personally identifiable health information is considered sensitive data that merits stronger safeguards. The FTC’s guidance for appropriately securing consumers’ personal information is
similar to what is required by the HIPAA Security Rule. In addition, certain state laws govern the privacy and security of personal information, including health information in certain circumstances, some of which are more stringent than HIPAA and
many of which differ from each other in significant ways and may not have the same effect, thus complicating compliance efforts. Many states are considering similar laws. Failure or perceived failure to comply with these laws, where applicable, can
result in material adverse effects to our business, including the imposition of significant civil and/or criminal penalties and private litigation.

As a health care
provider, we are also subject to Section 4004 of the 21 Century Cures Act, or Cures Act, and regulations promulgated by HHS related to patient access to electronic PHI, or EHI, to promote
interoperability and to ensure the access, exchange, or use of EHI.

Various U.S. states have implemented similar restrictive requirements regulating the use and
disclosure of health information and other personal information that are not necessarily preempted by HIPAA or that regulate different information than HIPAA. The California Consumer Privacy Act (CCPA), which went into effect January 1, 2020,
and California Privacy Rights Act of 2020 (CPRA), which went into effect on January