Company: TVRD
Filing Date: 2025-02-14
Form Type: S-4/A
Source: 0001104659-25-013053
Chunk: 454

Company: Tvardi Therapeutics, Inc.
Filing Date: 2025-02-14
Form: S-4/A
Chunk 454
---
 of Medicare provider or supplier numbers when detailing a provider of services, improper promotion of off-label uses not expressly approved by FDA in a drug’s label, and allegations as to misrepresentations with respect to the services rendered. Additionally, the civil monetary penalties statute, which, among other things, imposes fines against any person or entity who is determined to have presented, or caused to be presented, claims to a federal healthcare program that the person knows, or should know, is for an item or service that was not provided as claimed or is false or fraudulent. The federal Health Insurance Portability and Accountability Act of 1996, or HIPAA, created additional federal criminal statutes that prohibit knowingly and willfully executing, or attempting to execute, a scheme to defraud or to obtain, by means of false or fraudulent pretenses, representations, or promises, any of the money or property owned by, or under the custody or control of, any healthcare benefit program, including private third-party payers and knowingly and willfully falsifying, concealing or covering up by trick, scheme or device a

<div align='center'>260</div>

TABLE OF CONTENTS

material fact or making any materially false, fictitious or fraudulent statement in connection with the delivery of or payment for healthcare benefits, items or services relating to healthcare matters. Also, many states have similar fraud and abuse statutes or regulations that apply to items and services reimbursed under Medicaid and other state programs, or, in several states, apply regardless of the payer.

In addition, Cara is or may become subject to data privacy and security regulations by both the U.S. federal government and the state governments in which Cara conducts its business. HIPAA, as amended by HITECH and their respective implementing regulations, including the Final HIPAA Omnibus Rule published on January 25, 2013, imposes specified requirements on certain types of individuals and entities subject to the law, known as covered entities, such as certain healthcare providers, health plans, and healthcare clearinghouses, as well as their business associates that process individually identifiable health information on their behalf, relating to the privacy, security and transmission of individually identifiable health information as well as their covered subcontractors. Among other things, HITECH makes security standards and certain privacy standards directly applicable to the business associates of covered entities that perform services for them that involve the creation, use, maintenance or disclosure of, individually identifiable health information. HITECH also created four new tiers of civil monetary penalties, amended HIPAA to make civil and criminal penalties directly applicable