Company: BLLN
Filing Date: 2025-10-07
Form Type: S-1
Source: 0001193125-25-233697
Chunk: 255

Company: BillionToOne, Inc.
Filing Date: 2025-10-07
Form: S-1
Chunk 255
---
violation of Section 650 is punishable by up to one year of imprisonment, a fine up to $50,000, or both imprisonment and a fine. A violation of Section 14107.2 is punishable by imprisonment and fines of up to $10,000. The California
Insurance Code includes similar prohibitions against any consideration for the referral or procurement of patients if a claim is submitted to a commercial insurer, CA Ins. Code § 750, which is punishable by criminal penalties mirroring those
that apply to violations of Business and Professions Code Section 650.

Because each of our laboratories holds a New York CLEP permit, we must comply with New
York state laboratory statutes and regulations, which include anti-kickback provisions, Public Health Law Section 587, and Medicaid anti-kickback provisions, 18 NYCRR Section 515.2, related to laboratory services. The New York DOH may
suspend, limit, revoke or annul the New York laboratory permit or otherwise discipline the permit holder for a violation.

Data Privacy & Security

We are, or
may become, subject to numerous federal, state, local and foreign laws, regulations, standards, and guidance regarding data privacy and security.

190

The federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) created federal criminal statutes
relating to privacy of personal data. HIPAA imposes privacy, security and breach reporting obligations with respect to individually identifiable health information upon “covered entities” (health plans, health care clearinghouses and
certain health care providers), and their respective business associates, individuals or entities that create, received, maintain or transmit protected health information in connection with providing a service for or on behalf of a covered entity.
HIPAA mandates the reporting of certain breaches of health information to HHS, affected individuals and if the breach is large enough, the media. Entities that are found to be in violation of HIPAA, including as the result of a breach of unsecured
protected health information (PHI), a complaint about privacy practices or an audit by HHS, may be subject to significant civil, criminal and administrative fines and penalties and/or additional reporting and oversight obligations if required to
enter into a resolution agreement and corrective action plan with HHS to settle allegations of HIPAA non-compliance.

HIPAA
also prohibits knowingly and willfully executing, or attempting to execute, a scheme to defraud any healthcare benefit program, including private third-party payors, and knowingly and willfully falsifying, concealing