Company: BLLN
Filing Date: 2025-09-17
Form Type: DRS/A
Source: 0001193125-25-206347
Chunk: 255

Company: BillionToOne, Inc.
Filing Date: 2025-09-17
Form: DRS/A
Chunk 255
---
 CLEP permit, we must comply with New York state laboratory statutes and regulations, which include anti-kickback provisions, Public Health Law Section 587, and Medicaid anti-kickback provisions, 18 NYCRR Section 515.2, related
to laboratory services. The New York DOH may suspend, limit, revoke or annul the New York laboratory permit or otherwise discipline the permit holder for a violation.

Data Privacy & Security

We are, or
may become, subject to numerous federal, state, local and foreign laws, regulations, standards, and guidance regarding data privacy and security.

The federal Health
Insurance Portability and Accountability Act of 1996 (HIPAA) created federal criminal statutes relating to privacy of personal data. HIPAA imposes privacy, security and breach reporting obligations with respect to individually identifiable health
information upon “covered entities” (health plans, health care clearinghouses and certain health care providers), and their respective business associates, individuals or entities that create, received, maintain or transmit protected
health information in connection with providing a service for or on behalf of a covered entity. HIPAA mandates the reporting of certain breaches of health information to HHS, affected individuals and if the breach is large enough, the media.
Entities that are found to be in violation of HIPAA, including as the result of a breach of unsecured protected health information (PHI), a complaint about privacy practices or an audit by HHS, may be subject to significant civil, criminal and
administrative fines and penalties and/or additional reporting and oversight obligations if required to enter into a resolution agreement and corrective action plan with HHS to settle allegations of HIPAA
non-compliance.

HIPAA also prohibits knowingly and willfully executing, or attempting to execute, a scheme to defraud any
healthcare benefit program, including private third-party payors, and knowingly and willfully falsifying, concealing or covering up a material fact or making any materially false, fictitious or fraudulent statement in connection with the delivery of
or payment for healthcare benefits, items or services. Like the AKS, a person or entity does not need to have actual knowledge of the statute or specific intent to violate it to have committed a violation.

HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH) and their respective implementing regulations, impose
obligations on “covered entities,” including certain healthcare providers, health plans, and healthcare clearinghouses, as well as their respective “business associates”