Company: RNAC
Filing Date: 2025-03-13
Form Type: 10-K
Source: 0001453687-25-000060
Chunk: 114

Company: Cartesian Therapeutics, Inc.
Filing Date: 2025-03-13
Form: 10-K
Item: Item 1A
Chunk 114
---
CH, and their respective implementing regulations, which also impose obligations, including mandatory contractual terms, on certain types of people and entities with respect to safeguarding the privacy, security and transmission of individually identifiable health information;

•the federal Physician Payments Sunshine Act, or the Sunshine Act, which requires applicable manufacturers of certain products for which payment is available under a federal healthcare program to report annually to the government information related to certain payments or other “transfers of value” made to physicians (defined to include doctors, dentists, optometrists, podiatrists and chiropractors), certain other health care professionals beginning in 2022, and teaching hospitals, as well as ownership and investment interests held by the physicians and their immediate family members;

37

•analogous state laws and regulations, such as state anti-kickback and false claims laws, which may apply to sales or marketing arrangements and claims involving healthcare items or services reimbursed by third-party payors, including private insurers; and requirements to comply with federal and pharmaceutical industry compliance guidelines;

•state data privacy and price transparency laws, many of which differ from each other in significant ways and often are broader than and not preempted by HIPAA or the Sunshine Act, thus complicating compliance efforts; by way of example, the California Consumer Privacy Act, or CCPA, which went into effect January 1, 2020, among other things, creates new data privacy obligations for covered companies and provides new privacy rights to California residents, including the right to opt out of certain disclosures of their information. The CCPA also creates a private right of action with statutory damages for certain data breaches, thereby potentially increasing risks associated with a data breach. Although the law includes limited exceptions, including for “protected health information” maintained by a covered entity or business associate, it may regulate or impact our processing of personal information depending on the context; and

◦similar healthcare laws and regulations in the EU and other jurisdictions, including reporting requirements detailing interactions with and payments to healthcare providers and laws governing the privacy and security of certain protected information, such as the GDPR, which imposes obligations and restrictions on the collection and use of personal data relating to individuals located in the EU (including health data); in addition, the United Kingdom leaving the EU could also lead to further legislative and regulatory changes. It remains unclear how the United Kingdom data protection laws or regulations will develop in the medium to longer term and how data transfer to the United Kingdom from the EU will be regulated. However, the United Kingdom has transposed the GDPR into domestic