Company: BWAY
Filing Date: 2025-04-22
Form Type: 20-F
Source: 0001171843-25-002347
Chunk: 151

Company: Brainsway Ltd.
Filing Date: 2025-04-22
Form: 20-F
Item: Item 5
Chunk 151
---
, including health plans, healthcare clearinghouses,    
  and certain healthcare providers and their respective business associates that perform services on their behalf that involve individually       
  identifiable health information. HITECH also created new tiers of civil monetary penalties, amended HIPAA to make civil and criminal penalties  
  directly applicable to business associates, and gave state attorneys general new authority to file civil actions for damages or injunctions     
  in federal courts to enforce the HIPAA laws and seek attorneys’ fees and costs associated with pursuing federal civil actions;                  
 ──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

  the federal Physician Payments Sunshine Act, created under the PPACA, which requires                                                          

  foreign and state law equivalents of each of the above federal laws, such as anti-kickback                                                       
  and false claims laws, that may impose similar or more prohibitive restrictions, and may apply to items or services reimbursed by any            
  non-governmental third-party payors, including private insurers; state laws that require device manufacturers to comply with the industry’s      
  voluntary compliance guidelines and the applicable compliance guidance promulgated by the federal government or otherwise restrict payments      
  that may be made to healthcare providers and other potential referral sources; state laws that require device manufacturers to report            
  information related to payments and other transfers of value to physicians and other healthcare providers or marketing expenditures and          
  pricing information; and other federal and state laws that govern the privacy and security of health information or personally identifiable      
  information in certain circumstances, including state health information privacy and data breach notification laws which govern the collection,  
  use, disclosure, and protection of health-related and other personal information, many of which differ from each other in significant            
  ways and often are not preempted by HIPAA, thus requiring additional compliance efforts and data privacy and security laws and regulations       
  in foreign jurisdictions that may be more stringent than those in the United States (such as the European Union, which adopted the General       
  Data Protection Regulation, which became effective in May 2018).                                                                                 
 ───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

  88  

Because of the breadth of these laws and the narrowness
of their statutory exceptions and regulatory safe harbors, it is possible that some of a medical device manufacturer’s business
activities could be subject to challenge under one or more of these laws. The scope and enforcement of each of these laws is uncertain