Item 1. Business
Item 1. Business
 
Our Company
 
Astrotech Corporation (Nasdaq: ASTC) (“Astrotech,” the “Company,” “we,” “us,” or “our”), a Delaware corporation organized in 1984, is a mass spectrometry company that launches, manages, and commercializes scalable companies based on its innovative core technology.
 
Our efforts are focused on commercializing our platform mass spectrometry technology through our wholly-owned subsidiaries:
 
 
●
Astrotech Technologies, Inc. (“ATI”) owns and licenses the intellectual property related to the Astrotech Mass Spectrometer Technology™ (the “AMS Technology”).
 
 
●
1 st  Detect Corporation (“1 st  Detect”) is a manufacturer of explosives trace detectors capable of also detecting narcotics. It was developed for use at airports, cargo and other secured facilities, and borders worldwide. 1 st  Detect holds an exclusive AMS Technology license from ATI for air passenger and cargo security applications.
 
 
●
AgLAB, Inc. (“AgLAB”) is developing a series of mass spectrometers for use in the hemp and cannabis market with initial focus on optimizing yields in the extraction and distillation processes. AgLAB holds an exclusive AMS Technology license from ATI for agriculture applications.
 
 
●
BreathTech Corporation (“BreathTech”) is developing a breath analysis tool to screen for volatile organic compound (“VOC”) metabolites found in a person’s breath that could indicate they may have a bacterial or viral infection. BreathTech holds an exclusive AMS Technology license from ATI for breath analysis applications.
 
Business Developments
 
On August 3, 2021, AgLAB announced that it has hired Joe Levinthal, a hemp and cannabis industry veteran and an expert in mass spectrometry, as its Chief Science Officer, to help lead AgLAB’s product development team. Mr. Levinthal brings an extensive background in applying highly complex scientific instrumentation to develop products derived from hemp and cannabis, and he has worked with some of the leading companies in the industry.
 
On August 25, 2021, 1 st Detect announced that it secured an important landmark purchase order for the TRACER 1000™, representing the first units to be deployed at an airport security checkpoint.
 
On November 17, 2021, we announced that we are actively pursuing strategic and accretive acquisition opportunities for Astrotech Corporation and its subsidiaries. Tom Wilkinson, as Lead Independent Director, is focusing on identifying acquisitions that will complement or improve our core technology, accelerate revenue growth, and/or reduce time to market, while being accretive to earnings and therefore shareholder value.
 
On February 2, 2022, BreathTech announced that it has hired Dr. Karim Sirgi, MD, MBA and FCAP as its Chief Science Officer. Dr. Sirgi is a pathologist, board certified in Anatomic, Clinical and Cytopathology, and has over 30 years of practice and leadership experience in private and academic pathology practices. We expect Dr. Sirgi will be key in the research and development and regulatory efforts at BreathTech and will help lead our partnership with Cleveland Clinic in the development of the BreathTest-1000™.
 
On June 23, 2022, BreathTech announced that it has amended its Joint Development and Option Agreement with Cleveland Clinic to include additional areas of focus. Under the amended agreement, ongoing work towards development of a rapid breath test for COVID-19 will be expanded to utilize BreathTech’s core mass spectrometry technology to screen for a variety of diseases spanning the entire body. The project will focus on detecting bloodstream infections, respiratory infections such as influenza types A and B and respiratory syncytial virus (“RSV”), carriage of Staphylococcus aureus, and Clostridioides difficile (“C. diff”) infections.
 
As of the date of this filing, the TRACER 1000 is deployed in 20 locations across 11 countries throughout Europe and Asia.
 
5
Table of Contents
 
Our Business Units
 
Astrotech Technologies, Inc.
 
ATI owns and licenses the AMS Technology, the platform mass spectrometry technology originally developed by 1 st  Detect. Long recognized as the gold standard in chemical detection, mass spectrometry has historically been considered to be too costly, bulky, and cumbersome. In contrast, the AMS Technology has been designed to be comparatively inexpensive, small, and easy to use. Unlike other technologies, the AMS Technology works under ultra-high vacuum, which eliminates competing molecules, yielding higher resolution and fewer false alarms. The intellectual property includes 23 granted patents and one additional patent in process along with extensive trade secrets. With a number of diverse market opportunities for the core technology, ATI is structured to license the intellectual property for different fields of use. ATI currently licenses the AMS Technology to three wholly-owned subsidiaries of Astrotech on an exclusive basis, including to 1 st Detect for use in the security and detection market, to AgLAB for use in the agriculture market, and to BreathTech for use in breath analysis applications.
 
ATI has contracted with Sanmina Corporation (“Sanmina”), a leading contract manufacturer with a worldwide presence, to manufacture our mass spectrometer products. Leveraging their expertise, Sanmina has helped to improve the manufacturability and reliability of our systems.
 
1 st Detect Corporation
 
1 st  Detect, a licensee of ATI for the security and detection market, has developed the TRACER 1000, the world’s first mass spectrometer (“MS”) based explosives trace detector (“ETD”) certified by the European Civil Aviation Conference (“ECAC”), designed to replace the ETDs used at airports, cargo and other secured facilities, and borders worldwide. We believe that ETD customers are unsatisfied with the currently deployed ETD technology, which is driven by ion mobility spectrometry (“IMS”). We further believe that IMS-based ETDs are fraught with false positives, as they often misidentify personal care products and other common household chemicals as explosives, causing facility shutdowns, unnecessary delays, frustration, and significant wasted security resources. In addition, there are hundreds of different types of explosives, but IMS-based ETDs have a very limited threat detection library reserved only for those few explosives of largest concern. Adding additional compounds to the detection library of an IMS-based ETD fundamentally reduces the instrument’s performance, further increasing the likelihood of false alarms. In contrast, adding additional compounds to the TRACER 1000’s detection library does not degrade its detection capabilities, as it has a virtually unlimited and easily expandable threat library.
 
In order to sell the TRACER 1000 to airport and cargo security customers in the European Union and certain other countries, we obtained ECAC certification. We are currently selling the TRACER 1000 to customers who accept ECAC certification. We have deployed the TRACER 1000 in approximately 20 locations in 11 countries throughout Europe and Asia.
 
On August 25, 2021, 1 st Detect announced that it secured an important landmark purchase order from a distributor for the TRACER 1000, representing the first units to be deployed at an airport security checkpoint for passenger screening. These systems were sold to the customer during the second quarter of fiscal year 2022.
 
In the United States, we are working with the U.S. Transportation Security Administration (“TSA”) towards air cargo certification. On March 27, 2018, we announced that the TRACER 1000 was accepted into TSA’s Air Cargo Screening Technology Qualification Test (“ACSQT”) and, on April 4, 2018, we announced that the TRACER 1000 was beginning testing with TSA for passenger screening at airports. On November 14, 2019, we announced that the TRACER 1000 had been selected by the TSA’s Innovation Task Force to conduct live checkpoint screening at Miami International Airport. With similar protocols as ECAC testing, we have received valuable feedback from all programs. Following ECAC certification and our early traction within the cargo market, testing for cargo security continued with the TSA. With the onset of the COVID-19 pandemic, all testing within the TSA was put on hold; however, we resumed cargo testing during the summer of 2020, and we subsequently announced on September 9, 2020, that the TRACER 1000 passed the non-detection testing portion of the TSA’s ACSQT. Due to delays caused by COVID-19, TSA cargo detection testing is ongoing, but has proceeded much more slowly than originally anticipated. As a result, efforts are primarily focused on our other opportunities. TSA cargo detection testing is the final step to be listed on the Air Cargo Screening Technology List (“ACSTL”) as an “approved” device. If approved, the TRACER 1000 will be approved for cargo sales in the United States.
 
6
Table of Contents
 
AgLAB Inc.
 
AgLAB, an exclusive licensee of ATI for the agriculture market, has developed the AgLAB-1000™ series of mass spectrometers for use in the hemp and cannabis market with initial focus on optimizing yields in the extraction and distillation processes. The AgLAB product line is a derivative of our core AMS Technology. The AMS Technology provides a significant competitive advantage due to its small size, rugged design, quick analysis, and ease of use. AgLAB recently completed several successful field trials to demonstrate that the AgLAB-1000-D2™ can be used in the distillation process to significantly boost the potency and weight yields of tetrahydrocannabinol (“THC”) and cannabidiol (“CBD”) oil manufacturing. We plan to launch a family of “process control” instruments, methods, and solutions that we believe could be valuable additions to many nutraceutical extraction and distillation laboratories.
 
BreathTech Corporation
 
BreathTech, an exclusive licensee of ATI for use in breath analysis, is developing the BreathTest-1000, a breath analysis tool to screen for VOC metabolites found in a person’s breath that could indicate they may have a bacterial or viral infection. While vaccines have been deployed to mitigate the most serious effects of COVID-19, many people remain unvaccinated and new variants continue to pose a significant and evolving threat. New tools to aid in the battle against COVID-19 and other diseases remain of the utmost importance to help more quickly identify that an infection may be present, and BreathTech, in conjunction with Cleveland Clinic, is developing a quick and easy to use device to help determine the presence of infections.
 
In June 2022, we expanded our existing study that initially focused on COVID-19 with Cleveland Clinic to use the BreathTest-1000 to screen for a variety of diseases spanning the entire body. The project will focus on detecting bloodstream infections, respiratory infections such as influenza types A and B and RSV, carriage of Staphylococcus aureus, and C. diff infections.
 
Development of the BreathTest-1000 follows our results in pre-clinical trials for the BreathDetect-1000™, a rapid self-serve breathalyzer that was designed to detect bacterial infections in the respiratory tract, including pneumonia. The pre-clinical trials were conducted in collaboration with UT Health San Antonio in 2017.
 
Trends and Uncertainties - COVID-19
 
We are subject to risks and uncertainties as a result of the COVID-19 pandemic. To date, we have seen delays with respect to the TSA certification process and parts of our supply chain, particularly the impact of the global semiconductor and electronics shortage, which has now resulted in product pricing inflation. In addition, although passenger demand for air travel has rebounded, the overall recovery of the airline industry and ancillary services remains highly uncertain and is dependent upon, among other things, the number of cases declining around the globe, public health impacts of new COVID-19 variants, the continued administration of vaccines to unvaccinated populations, and the duration of immunity granted by vaccines.
 
We continue to manage production, to secure alternative supplies where available, and to take other proactive actions. We believe that we will be able to pass the inflation caused by raw materials shortages and increased shipping costs to our customers by increasing the price of our instruments. If supply chain shortages become more severe or longer term in nature, our business and results of operations could be adversely impacted; however, we do not expect this issue to materially adversely affect our liquidity position. The long-term impact of the COVID-19 pandemic on our business may not be fully reflected until future periods.
 
We continue to evaluate the current and potential impact of the pandemic on our business, results of operations, and consolidated financial statements. We also continue to actively monitor developments and business conditions, including those that may be related to additional COVID-19 variants and other diseases, that may cause us to take further actions that alter business operations as may be required by applicable authorities or that we determine are in the best interests of our employees, customers, suppliers, and stockholders.
 
7
Table of Contents
 
Business Strategy
 
1 st   Detect Corporation
 
There are tens of thousands IMS instruments deployed in the field today, with many nearing their end of life. As the current generation of IMS technology is replaced, we are working to position the Company as the next-generation solution for the ETD market with the introduction of the world’s first ETD driven by a mass spectrometer. With mass spectrometry being the gold standard of chemical detection, an MS-ETD significantly improves detection capabilities, dramatically reduces the number of false positives, decreases delays and the associated costs, and allows for a much more expansive library of compounds of interest, yielding an instrument that we believe is far superior to the currently deployed IMS instruments, at a similar price point and a lower operating cost.
 
We currently market the TRACER 1000 to countries that accept ECAC certification. If we obtain TSA certification and are listed on the ACSTL as an “approved” device, we plan to also market and sell the TRACER 1000 to those countries that accept TSA certification.
 
AgLAB Inc.
 
Initial interest for the AgLAB-1000 series has come from the hemp and cannabis industry. Many derivative hemp and cannabis products are being manufactured using cannabinoids present in the plant, primarily THC for cannabis and CBD for hemp. Extraction and distillation equipment is used to remove the cannabinoids from the raw plant matter to create an oil that is used in many manufactured products. AgLAB has launched the first of several planned products that have been designed to assist in the oil extraction and distillation processes by maximizing the final product quality and yield.
 
Current efforts are focused on the U.S. market, but international markets present attractive future growth opportunities as the number of countries with legal recreational or medicinal use continues to expand.
 
BreathTech Corporation
 
The BreathTest-1000 product that is currently under development is being designed to provide an inexpensive, non-invasive screening device for a variety of diseases, including COVID-19, that can offer results on-site in a very short period of time. We believe there remains a strong market need for a quick, frequent or daily screening test for use in high density and critical locations, especially with additional COVID-19 variants and other diseases continuing to pose new or reemerging threats. Most currently available tests either take too long or are invasive and painful. The market need for a quick and painless test is considered significant in the following target markets:
 
 
●
Hospitals
●
Military
 
●
Nursing homes
●
Sporting events
 
●
Airlines
●
Performing arts venues
 
●
Hotels
●
Convention and conference centers
 
●
Cruise lines
●
Schools
 
 
 
 
 
BreathTech is also working to expand the capabilities of the BreathTest-1000 to detect certain bloodstream and bacterial infections. 
 
Products and Services
 
1 st   Detect Corporation
 
The TRACER 1000 is the first MS-ETD certified by ECAC. We believe the TRACER 1000 significantly outperforms currently deployed competitive trace detection solutions based on IMS technology, specifically related to false alarm rate, probability of detection, and unit up-time. The majority of our sales to-date have come from the cargo security industry where false alarms can cause expensive delays and facility shutdowns as the false alarms are cleared, preventing the mission critical continuous flow of time sensitive packages. We have also recently expanded into the airport passenger screening market with sales to a distributor who services a major international airport in Asia in the second quarter of fiscal year 2022.
 
8
Table of Contents
 
AgLAB Inc.
 
Leveraging the platform AMS Technology, AgLAB is currently designing its product line to serve applications in the hemp and cannabis markets. AgLAB has launched the AgLAB-1000-D2 which is designed to optimize yield during the distillation process. With the AgLAB-1000-D2, a sample is manually introduced into the system for analysis. Currently under development is the AgLAB-1000-D1. When completed, this instrument will be an inline process control unit that will increase yields with additional possibilities in solvent and pesticide detection.
 
BreathTech Corporation
 
The BreathTest-1000 is being developed, in conjunction with Cleveland Clinic, to provide an inexpensive, non-invasive screening device for a variety of diseases, including COVID-19 and its variants as well as associated lung diseases. The BreathTest-1000 is being designed to detect VOC metabolites in a person’s breath that could indicate they may have an infection using a disposable collection tube.
 
Customers, Sales, and Marketing
 
1 st   Detect Corporation
 
Marketing efforts at 1 st  Detect are currently focused on foreign airports and commercial companies in aviation and cargo security. We employ both direct sales and channel sales through distributors. We now have units deployed in 20 locations in 11 countries. While we have had some degree of success with sales, much of the pipeline has seen delays caused by the COVID-19 pandemic.
 
AgLAB Inc.
 
Currently, AgLAB uses only direct sales. We do plan to engage with various channel partners, largely companies with existing distribution channels in the hemp and cannabis market, to help sell our products to target customers.
 
BreathTech Corporation
 
Efforts are currently focused on the development of the BreathTest-1000. We plan to increase marketing activities as the product approaches commercial viability.
 
Competition
 
1 st   Detect Corporation
 
Competition for the TRACER 1000 comes primarily from IMS-based ETDs. We have several competitors that sell IMS-based ETDs that are much larger than us, with well-established sales forces and offering a wider range of security products; however, we believe the TRACER 1000 has a number of attributes that are superior to competing products.
 
IMS-ETD
1 st  Detect’s TRACER 1000
 
●
False alarms caused by confusants
 
●
Near-zero false alarm rate
 
●
Lower probability of detection
 
●
Higher probability of detection
 
●
Numerous unscheduled bake-outs and calibrations
 
●
Near 100% up-time
 
●
Limited library of compounds of interest
 
●
Unlimited library of compounds of interest
 
●
Addition of new compounds may require hardware changes
 
●
Library updates that do not require hardware changes
 
●
Causes delays or shutdowns at security facilities/inspection checkpoints
 
●
Improves throughput at security facilities and checkpoints
 
●
Low price chemical detector
 
●
Competitive price to IMS in a throughput sensitive environment
 
These claims have been confirmed in numerous discussions with industry experts and verified in our many field trials.
 
AgLAB Inc. 
 
The currently available technology that we believe to be the only direct competition to our MS-based system is high performance liquid chromatography (“HPLC”). We believe the AgLAB-1000 series of products offers a more customer-friendly interface, quicker results, and, once the AgLAB-1000-D1 is launched, the ability to provide closed loop process control, ensuring maximum yield and product quality.
 
9
Table of Contents
 
BreathTech Corporation
 
The BreathTest-1000 product that is currently under development is being designed to screen for VOC metabolites found in a person’s breath that could indicate they may have a bacterial or viral infection. Given that breath samples are quick, inexpensive, and painless, we anticipate that the BreathTest-1000 will be in demand by hospitals, nursing homes, airlines, hotels, cruise lines, military, sporting events, performing arts venues, convention and conference centers, schools, and likely anywhere that has high concentrations of people. This product is not expected to compete with the currently available molecular tests like RT-PCR, but is intended to be a screening device that, upon a positive test, will suggest a more thorough evaluation. Other researchers are working on a breath screening solution for COVID-19, and to the best of our knowledge, only one company in the U.S. has gained Emergency Use Authorization (“EUA”) from the U.S. Food and Drug Administration (“FDA”) for a breath analysis device; however, it remains unclear if this product is commercially available at this time.
 
Research and Development
 
Astrotech Technologies, Inc.
 
We invest considerable resources into our internal research and development (“R&D”) functions. Much of our R&D investment is devoted to the cross-platform AMS Technology as the R&D team continually works to develop new derivative products, improve system functionality and reliability, optimize design, reduce cost, and streamline and simplify the software and user experience. Each market, however, typically requires unique sample introduction technology, library development, and customized adjustments to the user interface. 
 
1 st   Detect Corporation
 
While 1 st Detect’s TRACER 1000 is fully commercialized, we continue to invest in cross-platform improvements that benefit all of our products, including those that improve system functionality and reliability, optimize design, reduce cost, and streamline and simplify the software and user experience.
 
AgLAB Inc.
 
The AgLAB-1000 series uses the core AMS Technology and is continuing its development of its cannabinoid library. In addition, AgLAB continues to invest in and expand its product line to include other valuable products specific to the hemp and cannabis industry.
 
BreathTech Corporation
 
The BreathTest-1000 employs the core AMS Technology. BreathTech R&D activities are being devoted to sample introduction and library development, which is needed to identify the specific compounds present in the breath that are indicative of the presence of infections.
 
We have been in correspondence with the FDA regarding how the FDA will classify the BreathTest-1000 and the classification has not yet been determined. The classification will inform the required FDA premarket submission and review process that will follow. If premarket notification (510(k) submission) is required, we intend to submit a pre-submission request to the FDA. The pre-submission is a formal mechanism for requesting feedback from the FDA prior to submitting a medical device application. The timeframe for receiving feedback from a pre-submission request is approximately 70 calendar days but may be shorter or longer.
 
Simultaneously, we are exploring how to potentially accelerate our time to market for the BreathTest-1000 via the EUA process, pursuant to the EUA declaration for in vitro diagnostic tests (“IVDs”) that became effective on February 4, 2020, in connection with the public health emergency related to COVID-19. In relevant part, an EUA declaration allows the FDA to temporarily authorize the use of unapproved and uncleared medical countermeasures, such as, IVD tests that have not gone through the FDA’s review process in anticipation of a potential emergency or during an actual emergency involving a chemical, biological, radiological, or nuclear agent, or an emerging infectious disease where the U.S. Secretary of Health and Human Services (“HHS”) determines that circumstances exist to justify such authorization. Several COVID-19 diagnostic tests have been authorized through the EUA process, and such authorizations generally remain in effect until HHS declares the public health emergency is terminated or the conditions of the given EUA are not fulfilled. We have not submitted a request for an EUA but are hopeful that we will be able to obtain authorization under the EUA to get the BreathTest-1000 to market as quickly as possible. The timeframe for authorization of an EUA is highly variable and depends on, among other things, the complexity of the product, completeness of the submission, and technical requirements of the FDA. Authorization, if granted, may take as little as one month or as long as several months, and there is no guarantee that an EUA will be granted for the BreathTest-1000.
 
10
Table of Contents
 
Certain Regulatory Matters
 
We are subject to United States federal, state, and local laws and regulations designed to protect the environment and to regulate the discharge of materials into the environment. We are also beholden to certain regulations designed to protect our domestic technology from unintended foreign exploitation and regulate certain business practices. We believe that our policies, practices, and procedures are properly designed to prevent unreasonable risk of environmental damage and consequential financial liability. Our operations are also subject to various regulations under federal laws regarding the international transfer of technology, as well as to various federal and state laws related to business operations. In addition, we are subject to federal contracting procedures, audit, and oversight. Compliance with environmental laws and regulations and technology export requirements has not had and, we believe, will not have in the future, material effects on our capital expenditures, earnings, or competitive position.
 
Federal regulations that impact our operations include the following:
 
Foreign Corrupt Practices Act . The Foreign Corrupt Practices Act establishes rules for U.S. companies doing business internationally. Compliance with these rules is achieved through established and enforced corporate policies, documented internal procedures, and financial controls.
 
Iran Nonproliferation Act of 2000 . This act authorizes the President of the United States to take punitive action against individuals or organizations known to be providing material aid to weapons of mass destruction programs in Iran.
 
Federal Acquisition Regulations . Goods and services provided by us to U.S. Government agencies are subject to Federal Acquisition Regulations (“FAR”). These regulations provide rules and procedures for invoicing, documenting, and conducting business under contract with such entities. The FAR also subjects us to audit by federal auditors to confirm such compliance.
 
Truth in Negotiations Act . The Truth in Negotiations Act was enacted for the purpose of providing full and fair disclosure by contractors in the conduct of negotiations with the U.S. Government. The most significant provision included in the Truth in Negotiations Act is the requirement that contractors submit certified cost and pricing data for negotiated procurements above a defined threshold.
 
Export Administration Act . This act provides authority to regulate exports, to improve the efficiency of export regulation, and to minimize interference with the ability to engage in commerce.
 
Export Administration Regulations.  The Export Administration Regulations govern whether a person or company may export goods from the U.S., re-export goods from a foreign country, or transfer goods from one person or company to another in a foreign country.
 
Medical Device Regulation
 
FDA Premarket Clearance and Approval Requirements. Unless an exemption applies, each medical device, to be lawfully commercially distributed in the U.S., requires either FDA clearance of a 510(k) premarket notification submission, granting of a de novo request, or premarket application (“PMA”) approval. Under the Federal Food Drug and Cosmetic Act (“FDCA”), administered by the FDA, medical devices are classified into one of three classes, Class I, Class II, or Class III, depending on the degree of risk associated with each medical device and the extent of manufacturer and regulatory controls needed to ensure its safety and effectiveness. Class I includes devices with the lowest risk to the patient and are those for which safety and effectiveness can be assured by adherence to the FDA’s general controls for medical devices, which include compliance with the applicable portions of the Quality System Regulation (“QSR”), facility registration and product listing, reporting of adverse medical events, and truthful and non-misleading labeling, advertising, and promotional materials. Some Class I devices may require premarket notification to the FDA.
 
Class II devices are moderate risk devices and are subject to the FDA’s general controls, and certain special controls as deemed necessary by the FDA to ensure the safety and effectiveness of the device. These special controls can include performance standards, post-market surveillance, patient registries, and FDA guidance documents. While most Class I devices are exempt from the 510(k) premarket notification requirement, manufacturers of most Class II devices are required to submit to the FDA a premarket notification under Section 510(k) of the FDCA requesting permission to commercially distribute the device. The FDA’s permission to commercially distribute a device subject to a 510(k) premarket notification is generally known as 510(k) clearance. Under the 510(k) process, the manufacturer must submit to the FDA a premarket notification demonstrating that the device is “substantially equivalent” to either a device that was legally marketed prior to May 28, 1976, the date upon which the Medical Device Amendments of 1976 were enacted, or another commercially available device that was cleared to through the 510(k) or de novo process.
 
11
Table of Contents
 
Devices deemed by the FDA to pose the greatest risks, such as life-sustaining, life-supporting or some implantable devices, or devices that have a new intended use, or use advanced technology that is not substantially equivalent to that of a legally marketed device, are placed in Class III, requiring approval of a PMA. For a device that is Class III by default (because it is a novel device that was not previously classified and has no predicate), the device manufacturer may request that FDA reclassify the device into Class II or Class I via a de novo request.
 
510(k) Marketing Clearance. To obtain 510(k) clearance, a premarket notification submission must be submitted to the FDA demonstrating that the proposed device is “substantially equivalent” to a predicate device. A predicate device is a legally marketed device that is not subject to premarket approval, i.e., a device that was legally marketed prior to May 28, 1976 (pre-amendments device) and for which a PMA is not required, a device that has been reclassified from Class III to Class II or I (e.g., via the de novo classification process), or a device that was previously cleared through the 510(k) process. The FDA’s 510(k) review process usually takes from three to six months but may take longer. The FDA may require additional information, including clinical data, to make a determination regarding substantial equivalence. If the FDA agrees that the device is substantially equivalent to a predicate device, it will grant 510(k) clearance to market the device.
 
After a device receives 510(k) marketing clearance, any modification that could significantly affect its safety or effectiveness, or that would constitute a major change or modification in its intended use, will require a new 510(k) marketing clearance or, depending on the modification, a de novo request or PMA approval. The FDA requires each manufacturer to determine whether the proposed change requires submission of a 510(k), de novo or a PMA in the first instance, but the FDA can review that decision and disagree with a manufacturer’s determination. If the FDA disagrees with a manufacturer’s determination, the FDA may take a wide range of enforcement actions, including, but not limited to, issuing a warning letter, withdrawing existing 510(k) clearance(s), and/or requesting a recall of the modified device. In addition, the manufacturer must cease marketing of the modified device until FDA has cleared or approved a new 510(k), de novo or PMA for the change, if ever. Also, in these circumstances, the manufacturer may be subject to significant regulatory fines or penalties.
 
De Novo Process. If a previously unclassified new medical device does not qualify for the 510(k) pre-market notification process because no predicate device to which it is substantially equivalent can be identified, the device is automatically classified into Class III. The Food and Drug Administration Modernization Act of 1997 established a new route to market for low to moderate risk medical devices that are automatically placed into Class III due to the absence of a predicate device, called the “Request for Evaluation of Automatic Class III Designation,” or the de novo classification procedure. This procedure allows a manufacturer whose novel device is automatically classified into Class III to request down-classification of its medical device into Class I or Class II on the basis that the device presents low or moderate risk, rather than requiring the submission and approval of a PMA. Prior to the enactment of the Food and Drug Administration Safety and Innovation Act (“FDASIA”) in July 2012, a medical device could only be eligible for de novo classification if the manufacturer first submitted a 510(k) pre-market notification and received a determination from the FDA that the device was not substantially equivalent. FDASIA streamlined the de novo classification pathway by permitting (under Section 513(f)(2) of the FDCA) manufacturers to request de novo classification directly without first submitting a 510(k) pre-market notification to the FDA and receiving a not substantially equivalent determination. FDASIA sets a review time for FDA of 120 days following receipt of the de novo application, but FDA does not always meet this timeline and has publicly only committed to a review of 150 days for 50% of applications. If the manufacturer seeks reclassification into Class II, the manufacturer must include a draft proposal for special controls that are necessary to provide a reasonable assurance of the safety and effectiveness of the medical device. The FDA may reject the reclassification petition if it identifies a legally marketed predicate device that would be appropriate for a 510(k) or determines that the device is not low to moderate risk or that general controls would be inadequate to control the risks and special controls cannot be developed. If the FDA agrees with the down-classification, the de novo applicant will then receive authorization to market the device, and a classification regulation will be established for the device type. The device can then be used as a predicate device for future 510(k) submissions by the manufacturer or a competitor. In October 2021, FDA enacted regulations implementing the above-referenced FDCA provisions governing the de novo reclassification process.
 
12
Table of Contents
 
Premarket Approval Process. Class III devices require submission through the PMA process before they can be marketed. The PMA process is more demanding than the 510(k) premarket notification process. Under the PMA pathway, the manufacturer must demonstrate that the investigational device is safe and effective for the target indication(s) for use, and the PMA must be supported by extensive data, including data from preclinical studies and human clinical trials conducted under a valid investigational device exemption (“IDE”). The PMA must also contain, among other things, a full description of the device and its components, a full description of the methods, facilities and controls used for manufacturing, and proposed labeling. Following receipt of a PMA submission, the FDA determines whether the application is sufficiently complete to permit a substantive review. If the FDA accepts the application for review, it has 180 days under the FDCA to complete its review of a PMA, although in practice, the FDA’s review often takes significantly longer, and can take up to several years. An advisory panel of experts from outside the FDA may be convened to review and evaluate the application and provide recommendations to the FDA as to the approvability of the device. The FDA may or may not accept the panel’s recommendation. In addition, the FDA will generally conduct a preapproval inspection of the applicant or its third-party manufacturers’ or suppliers’ manufacturing facility or facilities to ensure compliance with the QSR.
 
The FDA will approve the new device for commercial distribution if it determines that the data and information in the PMA application constitute valid scientific evidence and that there is reasonable assurance that the device is safe and effective for its intended use(s). The FDA may approve a PMA application with post-approval conditions intended to ensure the safety and effectiveness of the device, including, among other things, restrictions on labeling, promotion, sale and distribution, and collection of long-term follow-up data from patients in the clinical study that supported PMA approval or requirements to conduct additional clinical studies post-approval. The FDA may condition PMA approval on some form of post-market surveillance when deemed necessary to protect the public health or to provide additional safety and efficacy data for the device in a larger population or for a longer period of use. In such cases, the manufacturer might be required to follow certain patient groups for a number of years and to make periodic reports to FDA on the clinical status of those patients. Failure to comply with the conditions of approval can result in material adverse enforcement action, including withdrawal of the approval.
 
Certain changes to an approved device, such as changes in manufacturing facilities, methods, or quality control procedures, or changes in the design performance specifications, which affect the safety or effectiveness of the device, require submission of a PMA supplement. PMA supplements often require submission of the same type of information as a PMA, except that the supplement is limited to information needed to support any changes from the device covered by the original PMA and may not require as extensive clinical data or the convening of an advisory panel. Certain other changes to an approved device require the submission of a new PMA, such as when the design change causes a different intended use, mode of operation, and technical basis of operation, or when the design change is so significant that a new generation of the device will be developed, and the data that were submitted with the original PMA are not applicable for the change in demonstrating a reasonable assurance of safety and effectiveness.
 
Emergency Use Authorization . The Commissioner of the FDA, under delegated authority from HHS may, under certain circumstances, issue an EUA, that would temporarily permit the use of an unapproved medical device or unapproved use of an approved medical device. Before an EUA may be issued, the HHS Secretary must declare that circumstances exist to justify the authorization (referred to as an “EUA declaration”) based on one of the following grounds:
 
 
●
a determination by the Secretary of the Department of Homeland Security (“DHS”) that there is a domestic emergency, or a significant potential for a domestic emergency, involving a heightened risk of attack with a specified biological, chemical, radiological or nuclear agent or agents;
 
 
●
a determination by the Secretary of Defense that there is a military emergency, or a significant potential for a military emergency, involving a heightened risk to U.S. military forces of attack with a specified biological, chemical, radiological, or nuclear agent or agents; 
 
 
●
a determination by the Secretary of HHS of a public health emergency that affects or has the significant potential to affect, national security or the health and security of U.S. citizens living abroad, and that involves a specified biological, chemical, radiological, or nuclear agent or agents, or a specified disease or condition that may be attributable to such agent or agents; or
 
 
●
the identification of a material threat, by the DHS Secretary pursuant to section 319F-2 of the Public Health Service (“PHS”) Act, that is sufficient to affect national security or the health and security of U.S. citizens living abroad.
 
In order for a medical countermeasure, such as an IVD (among others), to be the subject of an EUA, the FDA Commissioner must conclude that, based on the totality of scientific evidence available, it is reasonable to believe that the product may be effective in diagnosing, treating, or preventing a disease attributable to the agents described above, that the product’s potential benefits outweigh its potential risks and that there is no adequate, approved alternative to the product.
 
13
Table of Contents
 
Clinical Trials. Clinical trials are almost always required to support de novo or a PMA and are sometimes required to support a 510(k) submission. All clinical investigations of investigational devices to determine safety and effectiveness must be conducted in accordance with the FDA’s IDE regulations which govern investigational device labeling, prohibit promotion of the investigational device, and specify an array of recordkeeping, reporting and monitoring responsibilities of study sponsors and study investigators. If the device presents a “significant risk” to human health, as defined by the FDA, the FDA requires the device sponsor to submit an IDE application to the FDA, which must become effective prior to commencing human clinical trials. A significant risk device is one that presents a potential for serious risk to the health, safety or welfare of a patient and either is implanted, used in supporting or sustaining human life, substantially important in diagnosing, curing, mitigating or treating disease or otherwise preventing impairment of human health, or otherwise presents a potential for serious risk to a subject. An IDE application must be supported by appropriate data, such as animal and laboratory test results, showing that it is safe to test the device in humans and that the testing protocol is scientifically sound. The IDE will automatically become effective 30 days after receipt by the FDA, unless the FDA notifies the manufacturer that the investigation may not begin or is subject to a clinical hold. If the FDA determines that there are deficiencies or other concerns with an IDE for which it requires modification, the FDA may permit a clinical trial to proceed under a conditional approval.
 
In addition, clinical studies must be approved by, and conducted under the oversight of, an Institutional Review Board ("IRB") for each clinical site. The IRB is responsible for the initial and continuing review of the IDE and may pose additional requirements for the conduct of the trial. If an IDE application is approved by the FDA and one or more IRBs, human clinical trials may begin at a specific number of investigational sites with a specific number of patients, as approved by the FDA. If the device presents a non-significant risk to the patient, a sponsor may begin the clinical trial after obtaining approval for the trial by one or more IRBs without separate approval from the FDA, but must still follow abbreviated IDE requirements, such as monitoring the investigation, ensuring that the investigators obtain informed consent, and labeling and record-keeping requirements. An IDE supplement must be submitted to and approved by the FDA before a sponsor or investigator may make a change to the investigational plan.
 
During a clinical trial, the sponsor is required to comply with the applicable FDA requirements, including, for example, trial monitoring, selecting clinical investigators and providing them with the investigational plan, ensuring IRB review, adverse event reporting, record keeping, and prohibitions on the promotion of investigational devices or on making safety or effectiveness claims for them. The clinical investigators in the clinical study are also subject to FDA regulations and must obtain patient informed consent, rigorously follow the investigational plan and study protocol, control the disposition of the investigational device, and comply with all reporting and recordkeeping requirements. Additionally, after a trial begins, we, the FDA, or the IRB could suspend or terminate a clinical trial at any time for various reasons, including a belief that the risks to study subjects outweigh the anticipated benefits.
 
Post-market Regulation. After a device is cleared or approved for marketing, numerous and pervasive regulatory requirements continue to apply. These include (among others):
 
 
●
establishment registration and device listing with the FDA;
 
 
●
state licensure requirements for the manufacturing and distribution of medical devices;
 
 
●
FDA’s QSR requirements, which require manufacturers, including third-party manufacturers, to follow stringent design, testing, control, documentation, and other quality assurance procedures during all aspects of the design and manufacturing process;
 
 
●
FDA labeling and marketing regulations, which require that promotion is truthful, not misleading, fairly balanced, provide adequate directions for use, and that all claims are substantiated, and also prohibit the promotion of products for unapproved or “off-label” uses and impose other restrictions on labeling; 
 
 
●
FDA regulations and guidance pertaining to clearance or approval of product modifications to 510(k)-cleared devices that could significantly affect safety or effectiveness or that would constitute a major change in intended use of one of our cleared devices, or approval of a supplement for certain modifications to PMA devices;
 
14
Table of Contents
 
 
●
FDA’s medical device reporting ( “MDR”) regulations, which require that a manufacturer report to the FDA if a device it markets may have caused or contributed to a death or serious injury, or has malfunctioned and the device or a similar device that it markets would be likely to cause or contribute to a death or serious injury, if the malfunction were to recur;
 
 
●
FDA’s correction, removal, and recall reporting regulations, which require that manufacturers report to the FDA field corrections and product recalls or removals if undertaken to reduce a risk to health posed by the device or to remedy a violation of the FDCA that may present a risk to health;
 
 
●
FDA regulations requiring Unique Device Identifiers on devices and also requiring the submission of certain information about each device to the FDA’s Global Unique Device Identification Database;
 
 
●
the FDA’s recall authority, whereby the agency can order device manufacturers to recall from the market a product that is in violation of governing laws and regulations;
 
 
●
FDA post-market surveillance activities and regulations, which apply when deemed by the FDA to be necessary to protect the public health or to provide additional safety and effectiveness data for the device;
 
 
●
the federal Physician Sunshine Act and various state and foreign laws on reporting remunerative relationships with health care professionals, teaching hospitals, and other applicable entities;
 
 
●
the federal Anti-Kickback Statute (and similar state laws) prohibiting, among other things, soliciting, receiving, offering or providing remuneration intended to induce the purchase or recommendation of an item or service reimbursable under a federal healthcare program, such as Medicare or Medicaid. A person or entity does not have to have actual knowledge of this statute or specific intent to violate it to have committed a violation; and
 
 
●
the federal False Claims Act (and similar state laws) prohibiting, among other things, knowingly presenting, or causing to be presented, claims for payment or approval to the federal government that are false or fraudulent, knowingly making a false statement material to an obligation to pay or transmit money or property to the federal government or knowingly concealing, or knowingly and improperly avoiding or decreasing, an obligation to pay or transmit money to the federal government. The government may assert that claim includes items or services resulting from a violation of the federal Anti-Kickback Statute constitutes a false or fraudulent claim for purposes of the false claims statute.
 
We may be subject to similar foreign laws that may include applicable post-marketing requirements such as safety surveillance. With respect to any medical devices that we may commercialize in the U.S. in the future, our manufacturing processes, or those of any contract manufacturer that we engage, will be required to comply with the applicable portions of the QSR, which cover the methods and the facilities, controls for the design, manufacture, testing, production, processes, controls, quality assurance, labeling, packaging, distribution, installation, and servicing of finished devices intended for human use. The QSR also requires, among other things, maintenance of a device master file, device history file, and complaint files. The discovery of previously unknown problems with any of our products, including unanticipated adverse events or adverse events of increasing severity or frequency, whether resulting from the use of the device within the scope of its clearance or off-label by a physician in the practice of medicine, could result in restrictions on the device, including the removal of the product from the market or voluntary or mandatory device recalls.
 
The FDA has broad regulatory compliance and enforcement powers. If the FDA determines that we failed to comply with applicable regulatory requirements, it can take a variety of compliance or enforcement actions, which may result in any of the following sanctions:
 
 
●
warning letters, untitled letters, fines, injunctions, consent decrees, and civil penalties;
 
 
●
recalls, withdrawals, or administrative detention or seizure of our products;
 
 
●
operating restrictions or partial suspension or total shutdown of production (due to violations of the QSR or other applicable regulations) refusing or delaying requests for 510(k) marketing clearance or PMA approvals of new products or modified products;
 
 
●
withdrawing 510(k) clearances or PMA approvals that have already been granted;
 
 
●
refusal to grant export or import approvals for our products; or
 
 
●
criminal prosecution.
 
15
Table of Contents
 
Regulation of Medical Devices in the EEA
 
Medical devices placed on the market in the European Economic Area ("EEA") must meet the relevant essential requirements laid down in Annex I of Directive 93/42/EEC concerning medical devices ("the Medical Devices Directive"). The most fundamental essential requirement is that a medical device must be designed and manufactured in such a way that it will not compromise the clinical condition or safety of patients, or the safety and health of users and others. In addition, the device must achieve the performances intended by the manufacturer and be designed, manufactured, and packaged in a suitable manner. The European Commission has adopted various standards applicable to medical devices. These include standards governing common requirements, such as sterilization and safety of medical electrical equipment and product standards for certain types of medical devices. There are also harmonized standards relating to design and manufacture. While not mandatory, compliance with these standards is viewed as the easiest way to satisfy the essential requirements as a practical matter. Compliance with a standard developed to implement an essential requirement also creates a rebuttable presumption that the device satisfies that essential requirement.
 
To demonstrate compliance with the essential requirements laid down in Annex I to the Medical Devices Directive, medical device manufacturers must undergo a conformity assessment procedure, which varies according to the type of medical device and its classification. Conformity assessment procedures require an assessment of available clinical evidence, literature data for the product, and post-market experience in respect of similar products already marketed. Except for low-risk medical devices (Class I non-sterile, non-measuring devices), where the manufacturer can self-declare the conformity of its products with the essential requirements (except for any parts which relate to sterility or metrology), a conformity assessment procedure requires the intervention of a Notified Body. Notified bodies are often separate entities and are authorized or licensed to perform such assessments by government authorities. The notified body would typically audit and examine a product’s technical dossiers and the manufacturers’ quality system. If satisfied that the relevant product conforms to the relevant essential requirements, the notified body issues a certificate of conformity, which the manufacturer uses as a basis for its own declaration of conformity. The manufacturer may then apply the CE Mark to the device, which allows the device to be placed on the market throughout the EEA. Once the product has been placed on the market in the EEA, the manufacturer must comply with requirements for reporting incidents and field safety corrective actions associated with the medical device.
 
In order to demonstrate safety and efficacy for their medical devices, manufacturers must conduct clinical investigations in accordance with the requirements of Annex X to the Medical Devices Directive ("MDD"), Annex 7 of the Active Implantable Medical Devices Directive ("AIMDD"), and applicable European and International Organization for Standardization standards, as implemented or adopted in the EEA member states. Clinical trials for medical devices usually require the approval of an ethics review board and approval by or notification to the national regulatory authorities. Both regulators and ethics committees also require the submission of serious adverse event reports during a study and may request a copy of the final study report.
 
On April 5, 2017, the European Parliament passed the Medical Devices Regulation (Regulation 2017/745), which repeals and replaces the E.U. Medical Devices Directive and the Active Implantable Medical Devices Directive. Unlike directives, which must be implemented into the national laws of the EEA member States, the regulations would be directly applicable, i.e., without the need for adoption of EEA member State laws implementing them, in all EEA member States and are intended to eliminate current differences in the regulation of medical devices among EEA member States. The Medical Devices Regulation, among other things, is intended to establish a uniform, transparent, predictable, and sustainable regulatory framework across the EEA for medical devices and ensure a high level of safety and health while supporting innovation. The Medical Device Regulation will become applicable in May 2021. The new regulations:
 
 
●
strengthen the rules on placing devices on the market and reinforce surveillance once they are available;
 
 
●
establish explicit provisions on manufacturers’ responsibilities for the follow-up of the quality, performance, and safety of devices placed on the market;
 
 
●
improve the traceability of medical devices throughout the supply chain to the end-user or patient through a unique identification number;
 
 
●
set up a central database to provide patients, healthcare professionals, and the public with comprehensive information on products available in the E.U.;
 
 
●
strengthened rules for the assessment of certain high-risk devices, such as implants, which may have to undergo an additional check by experts before they are placed on the market.
 
16
Table of Contents
 
In the European Union, member states are responsible for enforcing the EU’s medical device rules and for ensuring that only compliant medical devices are placed on the market or put into service in their jurisdictions. They have powers to suspend the marketing and use, or demand the recall, of unsafe or non-compliant devices. They also have the power to bring enforcement action against companies or individuals for breaches of the device rules. Non-compliance may also result in Notified Bodies revoking any certificate of conformity that they have issued for a device or the manufacturer’s quality system.
 
We are subject to regulations and product registration requirements in many foreign countries in which we may sell our products, including in the areas of:
 
 
●
design, development, and manufacturing;
 
 
●
product standards;
 
 
●
product safety;
 
 
●
product safety reporting;
 
 
●
marketing, sales, and distribution;
 
 
●
packaging and storage requirements;
 
 
●
labeling requirements;
 
 
●
content and language of instructions for use;
 
 
●
clinical trials;
 
 
●
record keeping procedures;
 
 
●
advertising and promotion;
 
 
●
recalls and field corrective actions;
 
 
●
post-market surveillance, including reporting of deaths or serious injuries and malfunctions that, if they were to recur, could lead to death or serious injury;
 
 
●
import and export restrictions;
 
 
●
tariff regulations, duties, and tax requirements;
 
 
●
registration for reimbursement; and
 
 
●
necessity of testing performed in country by distributors for licensees.
 
The time required to obtain clearance required by foreign countries may be longer or shorter than that required for FDA clearance, and requirements for licensing a product in a foreign country may differ significantly from FDA requirements.
 
Federal, State, and Foreign Fraud and Abuse and Physician Payment Transparency Laws. In addition to FDA restrictions on marketing and promotion of drugs and devices, other federal and state laws may restrict our business practices if our products will be reimbursable under federal or state healthcare programs. These laws include, without limitation, foreign, federal, and state anti-kickback and false claims laws, as well as transparency laws regarding payments or other items of value provided to healthcare providers.
 
17
Table of Contents
 
The federal Anti-Kickback Statute prohibits, among other things, knowingly and willfully offering, paying, soliciting or receiving any remuneration (including any kickback, bribe or rebate), directly or indirectly, overtly or covertly, in cash or in kind to induce or in return for purchasing, leasing, ordering or arranging for or recommending the purchase, lease or order of any good, facility, item or service reimbursable, in whole or in part, under Medicare, Medicaid or other federal healthcare programs.
 
Violations of the federal Anti-Kickback Statute may result in civil monetary penalties up to $100,000 for each violation, plus up to three times the remuneration involved. Civil penalties for such conduct can further be assessed under the federal False Claims Act. Violations can also result in criminal penalties, including criminal fines of up to $100,000 and/or imprisonment of up to 10 years. Similarly, violations can result in exclusion from participation in government healthcare programs, including Medicare and Medicaid. Liability under the federal Anti-Kickback Statute may also arise because of the intentions or actions of the parties with whom we do business.
 
The federal civil False Claims Act prohibits, among other things, any person or entity from knowingly presenting, or causing to be presented, a false or fraudulent claim for payment or approval to the federal government or knowingly making, using or causing to be made or used a false record or statement material to a false or fraudulent claim to the federal government. A claim includes “any request or demand” for money or property presented to the U.S. government. The federal civil False Claims Act also applies to false submissions that cause the government to be paid less than the amount to which it is entitled, such as a rebate. Intent to deceive is not required to establish liability under the federal civil False Claims Act.
 
In addition, private parties may initiate “qui tam” whistleblower lawsuits against any person or entity under the federal civil False Claims Act in the name of the government and share in the proceeds of the lawsuit. Penalties for federal civil False Claim Act violations include fines for each false claim, plus up to three times the amount of damages sustained by the federal government and, most critically, may provide the basis for exclusion from the federally funded healthcare program The criminal False Claims Act prohibits the making or presenting of a claim to the government knowing such claim to be false, fictitious or fraudulent and, unlike the federal civil False Claims Act, requires proof of intent to submit a false claim. When an entity is determined to have violated the federal civil False Claims Act, the government may impose civil fines and penalties ranging from $11,803 to $23,607 for each false claim, plus treble damages, and exclude the entity from participation in Medicare, Medicaid, and other federal healthcare programs.
 
The Civil Monetary Penalty Act of 1981 imposes penalties against any person or entity that, among other things, is determined to have presented or caused to be presented a claim to a federal healthcare program that the person knows or should know is for an item or service that was not provided as claimed or is false or fraudulent, or offering or transferring remuneration to a federal healthcare beneficiary that a person knows or should know is likely to influence the beneficiary’s decision to order or receive items or services reimbursable by the government from a particular provider or supplier.
 
The Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act (“HITECH”) and including implementing regulations (collectively, “HIPAA”) also created additional federal criminal statutes that prohibit among other actions, knowingly and willfully executing, or attempting to execute, a scheme to defraud any healthcare benefit program, including private third-party payors, knowingly and willfully embezzling or stealing from a healthcare benefit program, willfully obstructing a criminal investigation of a healthcare offense, and knowingly and willfully falsifying, concealing or covering up a material fact or making any materially false, fictitious or fraudulent statement in connection with the delivery of or payment for healthcare benefits, items or services. Similar to the federal Anti-Kickback Statute, a person or entity does not need to have actual knowledge of the statute or specific intent to violate it in order to have committed a violation.
 
Many foreign countries have similar laws relating to healthcare fraud and abuse. Foreign laws and regulations may vary greatly from country to country. For example, the advertising and promotion of our products is subject to E.U. directives concerning misleading and comparative advertising and unfair commercial practices, as well as other EEA Member State legislation governing the advertising and promotion of medical devices. These laws may limit or restrict the advertising and promotion of our products to the general public and may impose limitations on our promotional activities with healthcare professionals. Also, many U.S. states have similar fraud and abuse statutes or regulations that may be broader in scope and may apply regardless of payor, in addition to items and services reimbursed under Medicaid and other state programs.
 
Data Privacy and Security Laws . In the future, we may also be subject to various federal, state, and foreign laws that protect personal information including certain patient health information, such as the E.U. General Data Protection Regulation (“GDPR”) and the California Consumer Privacy Act (“CCPA”), and restrict the use and disclosure of patient health information, such as HIPAA, and analogous state laws, many of which apply more broadly than HIPAA, in the U.S.
 
18
Table of Contents
 
HIPAA established uniform standards governing the conduct of certain electronic healthcare transactions and requires certain entities, called covered entities (as defined under HIPAA), to comply with standards that include the privacy and security of Protected Health Information (“PHI”). HIPAA also requires business associates (as defined under HIPAA), that may include  independent contractors or agents of covered entities that access, use or disclose PHI in connection with providing a service to or on behalf of a covered entity to enter into business associate agreements with the covered entity and to safeguard the covered entity’s PHI against improper use and disclosure.
 
The HIPAA privacy regulations cover the use and disclosure of PHI by covered entities as well as business associates, which are defined to include subcontractors that create, receive, maintain, or transmit PHI on behalf of a business associate. They also set forth certain rights that an individual has with respect to his or her PHI maintained by a covered entity, including the right to access or amend certain records containing PHI, or to request restrictions on the use or disclosure of PHI. The security regulations establish requirements for safeguarding the confidentiality, integrity, and availability of PHI that is electronically transmitted or electronically stored. HITECH, among other things, established certain health information security breach notification requirements. A covered entity must notify any individual whose PHI is breached according to the specifications set forth in the breach notification rule. The HIPAA privacy and security regulations establish a uniform federal “floor” and do not supersede state laws that are more stringent or provide individuals with greater rights with respect to the privacy or security of, and access to, their records containing PHI or insofar as such state laws apply to personal information that is broader in scope than PHI as defined under HIPAA.
 
HIPAA requires the notification of patients, and other compliance actions, in the event of a breach of unsecured PHI. If notification to patients of a breach is required, such notification must be provided without unreasonable delay and in no event later than 60 calendar days after discovery of the breach. In addition, if the PHI of 500 or more individuals is improperly used or disclosed, we would be required to report the improper use or disclosure to HHS which would post the violation on its website, and to the media. Failure to comply with the HIPAA privacy and security standards can result in civil monetary penalties up to $63,973 per violation, not to exceed an aggregate of $1.92 million per calendar year, and, in certain circumstances, criminal penalties with fines up to $250,000 per violation and/or imprisonment.
 
HIPAA authorizes state attorneys general to file suit on behalf of their residents for violations. Courts are able to award damages, costs and attorneys’ fees related to violations of HIPAA in such cases. While HIPAA does not create a private right of action allowing individuals to file suit against us in civil court for violations of HIPAA, its standards have been used as the basis for duty of care cases in state civil suits such as those for negligence or recklessness in the misuse or breach of PHI. In addition, HIPAA mandates that the Secretary of HHS conduct periodic compliance audits of HIPAA covered entities, and their business associates for compliance with the HIPAA privacy and security standards. It also tasks HHS with establishing a methodology whereby harmed individuals who were the victims of breaches of unsecured PHI may receive a percentage of the civil monetary penalty paid by the violator.
 
In addition, California enacted the CCPA, effective January 1, 2020, which, among other things, creates new data privacy obligations for covered companies and provides new privacy rights to California residents, including the right to opt out of certain disclosures of their information. The CCPA also creates a private right of action with statutory damages for certain data breaches, thereby potentially increasing risks associated with a data breach. Although the law includes limited exceptions, including for “protected health information” maintained by a covered entity or business associate, it may regulate or impact our processing of personal information depending on the context.
 
In the EEA, we may become subject to laws which restrict our collection, control, processing, and other use of personal data (i.e., data relating to an identifiable living individual) including the GDPR (and any national laws implementing the GDPR). As part of our operations, we process personal data belonging to data subjects in the EEA, including employees, contractors, suppliers, distributors, service providers, customers, patients, or clinical trial participants. For patients or clinical trial participants, we process special categories of personal data like health and medical information. We need to ensure compliance with the GDPR (and any applicable national laws implementing the GDPR) in each applicable EEA jurisdiction.
 
Healthcare Reform. The U.S. and some foreign jurisdictions are considering or have enacted a number of legislative and regulatory proposals to change the healthcare system in ways that could affect our ability to sell our products profitably. Among policy makers and payors in the U.S. and elsewhere, there is significant interest in promoting changes in healthcare systems with the stated goals of containing healthcare costs, improving quality or expanding access. Current and future legislative proposals, on both a national and state level, to further reform healthcare or reduce healthcare costs may limit coverage of or lower reimbursement for the procedures associated with the use of our products. The cost containment measures that payors and providers are instituting and the effect of any healthcare reform initiative implemented in the future could impact our revenue from the sale of our medical products, to the extent any are authorized for commercialization in the United States.
 
19
Table of Contents
 
We expect additional state and federal healthcare reform measures to be adopted in the future, any of which could limit the amounts that federal and state governments will pay for healthcare products and services, which could result in reduced demand for our products or additional pricing pressure.
 
Regulatory Compliance and Risk Management
 
We maintain compliance with regulatory requirements and manage our risks through a program of compliance, awareness, and insurance, which includes maintaining certain insurances and a continued emphasis on safety to mitigate any risks.
 
Employees Update
 
As of June 30, 2022, we employed 14 employees, none of which were covered by any collective bargaining agreements.
 
Text extracted from the filing as submitted to EDGAR. Formatting, tables and exhibits are simplified for reading; the original document is authoritative for anything you rely on.