Company: BLLN
Filing Date: 2025-08-11
Form Type: DRS/A
Source: 0000950123-25-007483
Chunk: 236

Company: BillionToOne, Inc.
Filing Date: 2025-08-11
Form: DRS/A
Chunk 236
---
 arrangements. California’s state anti-kickback statutes, Business and Professions Code Section 650 (which applies to all categories of payors) and Insurance Code
Section 754, and its Medi-Cal anti-kickback statute, Welfare and Institutions Code Section 14107.2, are analogous to, and have been interpreted by the California Attorney General and California courts in substantially the same way as the
federal government and the courts have interpreted, the federal Anti-Kickback Statute. A violation of Section 650 is punishable by up to one year of imprisonment, a fine up to $50,000, or both imprisonment and a fine. A violation of
Section 14107.2 is punishable by imprisonment and fines of up to $10,000. The California Insurance Code includes similar prohibitions against any consideration for the referral or procurement of patients if a

179

claim is submitted to a commercial insurer, CA Ins. Code § 750, which is punishable by criminal penalties mirroring those that apply to violations of Business and Professions Code
Section 650.

Because each of our laboratories holds a New York CLEP permit, we must comply with New York state laboratory statutes and regulations, which
include anti-kickback provisions, Public Health Law Section 587, and Medicaid anti-kickback provisions, 18 NYCRR Section 515.2, related to laboratory services. The New York DOH may suspend, limit, revoke or annul the New York laboratory
permit or otherwise discipline the permit holder for a violation.

Data Privacy & Security

We are, or
may become, subject to numerous federal, state, local and foreign laws, regulations, standards, and guidance regarding data privacy and security.

The federal Health
Insurance Portability and Accountability Act of 1996 (HIPAA) created federal criminal statutes relating to privacy of personal data. HIPAA imposes privacy, security and breach reporting obligations with respect to individually identifiable health
information upon “covered entities” (health plans, health care clearinghouses and certain health care providers), and their respective business associates, individuals or entities that create, received, maintain or transmit protected
health information in connection with providing a service for or on behalf of a covered entity. HIPAA mandates the reporting of certain breaches of health information to HHS, affected individuals and if the breach is large enough, the media.
Entities that are found to be in violation of HIPAA, including as the result of a breach of unsecured protected health information (PHI), a complaint