Company: QTIWW
Filing Date: 2025-03-31
Form Type: 10-K
Source: 0001844505-25-000038
Chunk: 62

Company: QT IMAGING HOLDINGS, INC.
Filing Date: 2025-03-31
Form: 10-K
Item: Item 1
Chunk 62
---
 ACA may be brought, and it is unclear how any future decisions and other efforts to repeal and replace the ACA will impact the ACA.

Other legislative changes have been proposed and adopted in the United States since the ACA was enacted, including aggregate reductions of Medicare payments to providers of 2% per fiscal year and reduced payments to several types of Medicare providers. We believe the overall escalating cost of medical products and services being paid for by the government and private health insurance has led to, and will continue to lead to, increased pressures on the healthcare and medical device industry to reduce the costs of products and services.

Data Privacy and Security

Medical device companies may be subject to U.S. federal and state and foreign health information privacy, security and data breach notification laws, which may govern the collection, use, disclosure and protection of health-related and other personal information. In the U.S., HIPAA imposes privacy, security and breach reporting obligations with respect to individually identifiable health information upon “covered entities” (health plans, health care clearinghouses and certain health care providers), and their respective business associates, individuals or entities that create, receive, maintain or transmit protected health information in connection with providing a service for or on behalf of a covered entity. HIPAA and its respective implementing regulations, including the final omnibus rule published on January 25, 2013, imposes specified requirements relating to the privacy, security and transmission of individually identifiable health information. HIPAA mandates the reporting of certain breaches of health information to HHS, affected individuals and if the breach is large enough, the media. Entities that are found to be in violation of HIPAA as the result of a breach of unsecured protected health information (“PHI”), a complaint about privacy practices or an audit by HHS, may be subject to significant civil, criminal and administrative fines and penalties and/or additional reporting and oversight obligations if required to enter into a resolution agreement and corrective action plan with HHS to settle allegations of HIPAA non-compliance. The Health Information Technology and Clinical Health Act also increased the civil and criminal penalties that may be imposed against covered entities, business associates and possibly other persons, and gave state attorneys general new authority to file civil actions for damages or injunctions in federal courts to enforce the federal HIPAA laws and seek attorney’s fees and costs associated with pursuing federal civil actions.

Even when HIPAA does not apply, according to the Federal Trade Commission (the “FTC”), failing to take appropriate steps to keep consumers’ personal information secure constitutes unfair acts or practices in or affecting commerce in violation