Company: VCYT
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0001384101-25-000014
Chunk: 28

Company: VERACYTE, INC.
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1
Chunk 28
---
 on the requirements derived from EU law as currently implemented in the UK. CE marks and certificates issued by EU-designated notified regulatory bodies for medical devices and IVDs will continue to be valid for the Great Britain market until 2028 and 2030, respectively. For medical devices, including IVDs, placed on the market in Great Britain after this period, the UKCA marking will be mandatory. In contrast, UKCA marking and certificates issued by UK notified regulatory bodies are not recognized on the EU market.

The position in Northern Ireland is different to Great Britain. The rules for placing medical devices and IVDs on the Northern Ireland market align with the rules in the EU and, as such, the IVDR will apply in Northern Ireland and will take effect in accordance with EU timeframes and transitional periods.  Therefore, devices marketed in Northern Ireland will require assessment according to the EU regulatory regime. Such assessment may be conducted by an EU notified body, in which case a CE mark will be required before placing the device on the market in the EU or Northern Ireland. Alternatively, if a UK notified body conducts such assessment, a “UKNI” mark will be applied, and the device may only be placed on the market in Northern Ireland and not the EU.

Privacy and Fraud and Abuse Compliance

Health Insurance Portability and Accountability Act and State Data Privacy Laws

Under the federal Health Insurance Portability and Accountability Act of 1996, or HIPAA, as amended through the Health Information Technology for Economic and Clinical Health Act, or HITECH, the United States Department of Health and Human Services, or HHS, has issued regulations to protect the privacy and security of protected health information used or disclosed by covered entities, which include health care providers, such as us. HIPAA also regulates standardization of data content, codes and formats used in health care transactions and standardization of identifiers for health plans and providers. Among the implementing regulations, covered entities are vicariously liable for violations of HIPAA resulting from acts or 

13

omissions of their business associates where the business associate is an agent of the covered entity and was acting within the scope of its agency, regardless of whether the covered entity and business associate entered into a business associate agreement in compliance with HIPAA. Penalties for violations of HIPAA regulations include civil and criminal penalties. 

We have developed and implemented policies and procedures designed to comply with HIPAA’s privacy, security, and breach notification requirements. We may not use or disclose protected health information in any form,