Company: MDXG
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0001376339-25-000009
Chunk: 69

Company: MIMEDX GROUP, INC.
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1
Chunk 69
---
 to report information to CMS related to certain payments or other transfers of value we make to U.S.-licensed physicians and teaching hospitals, and for reports submitted on or after January 1, 2022, physician assistants, nurse practitioners, clinical nurse specialists, certified nurse anesthetists and certified nurse-midwives. Such information will subsequently be made publicly available by CMS on the Open Payments website. There is a risk we do not report the information related to HELIOGEN accurately and that CMS or another government agency may take the position that our other products are not human cell and tissue products 

16

regulated solely under Section 361, and thereby assert that we are currently subject to the Sunshine Act, which could subject us to civil penalties and the administrative burden of having to comply with the law. 

•Federal conflicts of interest laws, the Standards of Ethical Conduct for Employees of the Executive Branch, and local site policies for each federal institution we call upon govern our interactions with federal employees at our various government accounts (e.g., DoD, VA, etc.) and impose a number of limitations on such interactions.

•There are state law equivalents of each of the above federal laws, such as anti-kickback and false claims laws, which may apply to items or services reimbursed by any third-party payer, including commercial insurers, many of which differ from each other in significant ways and often are not preempted by federal laws, thus complicating compliance efforts.

In addition, we may be subject to data privacy and security regulation by both the federal government and the states in which we conduct our business. HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act (“HITECH”) and its implementing regulations, imposes certain requirements relating to the privacy, security and transmission of protected health information. Among other things, HITECH made HIPAA’s privacy and security standards directly applicable to “business associates,” independent contractors or agents of covered entities that receive or obtain protected health information in connection with providing a service on behalf of a covered entity. HITECH also created four new tiers of civil monetary penalties, amended HIPAA to make civil and criminal penalties directly applicable to business associates and possibly other persons and gave state attorneys general new authority to file civil actions for damages or injunctions in federal courts to enforce the federal HIPAA laws and seek attorneys’ fees and costs associated with pursuing federal civil actions. In addition, state laws govern the privacy and security of health information in certain circumstances, many of which differ from each other in significant ways and may