Company: QTIWW
Filing Date: 2025-11-03
Form Type: S-1
Source: 0001628280-25-048373
Chunk: 77

Company: QT IMAGING HOLDINGS, INC.
Filing Date: 2025-11-03
Form: S-1
Chunk 77
---
 breach litigation. The CCPA may increase our compliance costs and potential liability, and many similar laws have been proposed at the federal level and in other states.

In addition, we expect to obtain health information that is subject to privacy and security requirements under HITECH and its implementing regulations. The privacy standards and security standards under HIPAA establish a set of standards for the protection of individually identifiable health information by health plans, health care clearinghouses and certain health care providers, (collectively referred to as “Covered Entities”), and the business associates with whom Covered Entities enter into service relationships pursuant to which individually identifiable health information may be exchanged. Notably, whereas HIPAA previously directly regulated only Covered Entities, HITECH makes certain of HIPAA’s privacy and security standards also directly applicable to Covered Entities’ business associates. As a result, both Covered Entities and business associates are now subject to significant civil and criminal penalties for failure to comply with privacy standards and security standards. As part of our normal operations, we expect to collect, process and retain personal identifying information regarding patients, including as a business associate of Covered Entities, so we expect to be subject to HIPAA, including changes implemented through HITECH, and we could be subject to criminal penalties if we knowingly obtain or disclose individually identifiable health information in a manner that is not authorized or permitted by HIPAA. A data breach affecting sensitive personal information, including health information, also could result in significant legal and financial exposure and reputational damages that could potentially have an adverse effect on our business.

HIPAA requires Covered Entities (like many of our potential customers) and business associates, like us, to develop and maintain policies and procedures with respect to protected health information that is used or disclosed, including the adoption of administrative, physical and technical safeguards to protect such information. HITECH

<div align='center'>46</div>

expands the notification requirement for breaches of patient-identifiable health information, restricts certain disclosures and sales of patient-identifiable health information and provides for civil monetary penalties for HIPAA violations. HITECH also increased the civil and criminal penalties that may be imposed against Covered Entities and business associates and gave state attorneys general new authority to file civil actions for damages or injunctions in federal courts to enforce HIPAA and its implementing regulations and seek attorney’s fees and costs associated with pursuing federal civil actions. Additionally, certain states have adopted comparable privacy and security laws and regulations, some of which may be more stringent than HIPAA.

Internationally, many jurisdictions have or are considering enacting privacy