Company: BLLN
Filing Date: 2025-10-17
Form Type: S-1/A
Source: 0001193125-25-242632
Chunk: 261

Company: BillionToOne, Inc.
Filing Date: 2025-10-17
Form: S-1/A
Chunk 261
---
 of unsecured
protected health information (PHI), a complaint about privacy practices or an audit by HHS, may be subject to significant civil, criminal and administrative fines and penalties and/or additional reporting and oversight obligations if required to
enter into a resolution agreement and corrective action plan with HHS to settle allegations of HIPAA non-compliance.

HIPAA
also prohibits knowingly and willfully executing, or attempting to execute, a scheme to defraud any healthcare benefit program, including private third-party payors, and knowingly and willfully falsifying, concealing or covering up a material fact
or making any materially false, fictitious or fraudulent statement in connection with the delivery of or payment for healthcare benefits, items or services. Like the AKS, a person or entity does not need to have actual knowledge of the statute or
specific intent to violate it to have committed a violation.

HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act of 2009
(HITECH) and their respective implementing regulations, impose obligations on “covered entities,” including certain healthcare providers, health plans, and healthcare clearinghouses, as well as their respective “business
associates” that create, receive, maintain or transmit individually identifiable health information for or on behalf of a covered entity, with respect to safeguarding the privacy, security and transmission of individually identifiable health
information. Additionally, HITECH created four new tiers of civil monetary penalties, amended HIPAA to make civil and criminal penalties directly applicable to business associates, and gave state attorneys general new authority to file civil actions
for damages or injunctions in U.S. federal courts to enforce HIPAA and seek attorneys’ fees and costs associated with pursuing federal civil actions.

Even
when HIPAA does not apply, failing to take appropriate steps to keep consumers’ personal information secure may constitute unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act,
15 U.S.C § 45(a). The FTC expects a company’s data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of
available tools to improve security and reduce vulnerabilities. Personally identifiable health information is considered sensitive data that merits stronger safeguards. The FTC’s guidance for appropriately securing consumers’ personal
information is similar to what is required by the HIPAA Security Rule. In addition, certain state laws govern the privacy and security of personal information, including health information in certain circumstances